Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ised to rotate their updater private key if they are affected by this (requires Tauri CLI >=1.5.5). After updating the envPrefix configuration, generate a new private key with `tauri signer generate`, saving the new private key and updating the updater's `pubkey` value on `tauri.conf.json` with the new public key. To update your existing application, the next application build must be signed with the older private key in order to be accepted by the existing application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tauri-apps/tauri/security/advisories/GHSA-2rcp-jvr4-r259 - https://tauri.app/v1/guides/getting-started/setup/vite/
CVE ID: CVE-2023-46116 State: PUBLISHED Published: 2023-12-15T13:44:05.153Z Last Updated: 2024-10-08T14:14:03.776Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: tutao Products: tutanota Problem Types: CWE-20 Description: Tutanota (Tuta Mail) is an encrypted email provider. Tutanota allows users to open links in emails in external applications. Prior to version 3.118.12, it correctly blocks the `file:` URL scheme, which can be used by malicious actors to gain code execution on a victims computer, however fails to check other harmful schemes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an at
mes such as `ftp:`, `smb:`, etc. which can also be used. Successful exploitation of this vulnerability will enable an attacker to gain code execution on a victim's computer. Version 3.118.2 contains a patch for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tutao/tutanota/security/advisories/GHSA-mxgj-pq62-f644 - https://github.com/tutao/tutanota/commit/88ecad17d00d05a722399aed35f0d280899d55a2 - https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L417 - https://github.com/tutao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423 - https://user-images.githubusercontent.com/46137338/2705
tao/tutanota/blob/master/src/desktop/ApplicationWindow.ts#L423 - https://user-images.githubusercontent.com/46137338/270564886-7a0389d3-f9ef-44e1-9f5e-57ccc72dcaa8.mp4
CVE ID: CVE-2023-46117 State: PUBLISHED Published: 2023-10-20T18:21:09.215Z Last Updated: 2024-09-12T15:47:08.174Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: six2dez Products: reconftw Problem Types: CWE-78 Description: reconFTW is a tool designed to perform automated recon on a target domain by running the best set of tools to perform scanning and finding out vulnerabilities. A vulnerability has been identified in reconftw where inadequate validation of retrieved subdomains may lead to a Remote Code Execution (RCE) attack. An attacker can exploit this vulnerability by crafting a malicious CSP entry on it's own domain. Successful exploitation can lead
er can exploit this vulnerability by crafting a malicious CSP entry on it's own domain. Successful exploitation can lead to the execution of arbitrary code within the context of the application, potentially compromising the system. This issue has been addressed in version 2.7.1.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/six2dez/reconftw/security/advisories/GHSA-fxwr-vr9x-wvjp - https://github.com/six2dez/reconftw/commit/e639de356c0880fe5fe01a32de9d0c58afb5f086
CVE ID: CVE-2023-46118 State: PUBLISHED Published: 2023-10-24T23:27:06.952Z Last Updated: 2025-02-13T17:14:16.640Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: rabbitmq Products: rabbitmq-server Problem Types: CWE-400 Description: RabbitMQ is a multi-protocol messaging and streaming broker. HTTP API did not enforce an HTTP request body limit, making it vulnerable for denial of service (DoS) attacks with very large messages. An authenticated user with sufficient credentials can publish a very large messages over the HTTP API and cause target node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3
get node to be terminated by an "out-of-memory killer"-like mechanism. This vulnerability has been patched in versions 3.11.24 and 3.12.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rabbitmq/rabbitmq-server/security/advisories/GHSA-w6cq-9cf4-gqpg - https://www.debian.org/security/2023/dsa-5571 - https://lists.debian.org/debian-lts-announce/2023/12/msg00009.html
CVE ID: CVE-2023-46119 State: PUBLISHED Published: 2023-10-25T00:03:55.774Z Last Updated: 2024-09-10T15:56:13.252Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: parse-community Products: parse-server Problem Types: CWE-23 Description: Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. Parse Server crashes when uploading a file without extension. This vulnerability has been patched in versions 5.5.6 and 6.3.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579 - https://github.com/p
rences: - https://github.com/parse-community/parse-server/security/advisories/GHSA-792q-q67h-w579 - https://github.com/parse-community/parse-server/commit/686a9f282dc23c31beab3d93e6d21ccd0e1328fe - https://github.com/parse-community/parse-server/commit/fd86278919556d3682e7e2c856dfccd5beffbfc0 - https://github.com/parse-community/parse-server/releases/tag/5.5.6 - https://github.com/parse-community/parse-server/releases/tag/6.3.1
CVE ID: CVE-2023-46120 State: PUBLISHED Published: 2023-10-24T23:05:24.172Z Last Updated: 2024-09-11T13:20:34.629Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: rabbitmq Products: rabbitmq-java-client Problem Types: CWE-400 Description: The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. `maxBodyLebgth` was not used when receiving Message objects. Attackers could send a very large Message causing a memory overflow and triggering an OOM Error. Users of RabbitMQ may suffer from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability
from DoS attacks from RabbitMQ Java client which will ultimately exhaust the memory of the consumer. This vulnerability was patched in version 5.18.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rabbitmq/rabbitmq-java-client/security/advisories/GHSA-mm8h-8587-p46h - https://github.com/rabbitmq/rabbitmq-java-client/issues/1062 - https://github.com/rabbitmq/rabbitmq-java-client/commit/714aae602dcae6cb4b53cadf009323ebac313cc8 - https://github.com/rabbitmq/rabbitmq-java-client/releases/tag/v5.18.0
CVE ID: CVE-2023-46121 State: PUBLISHED Published: 2023-11-14T23:31:55.145Z Last Updated: 2024-08-29T15:19:23.948Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: yt-dlp Products: yt-dlp Problem Types: CWE-444 Description: yt-dlp is a youtube-dl fork with additional features and fixes. The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. Version 2023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use t
023.11.14 removed the ability to smuggle `http_headers` to the Generic extractor, as well as other extractors that use the same pattern. Users are advised to upgrade. Users unable to upgrade should disable the Ggneric extractor (or only pass trusted sites with trusted content) and ake caution when using `--no-check-certificate`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/yt-dlp/yt-dlp/security/advisories/GHSA-3ch3-jhc6-5r8x - https://github.com/yt-dlp/yt-dlp/commit/f04b5bedad7b281bee9814686bba1762bae092eb - https://github.com/yt-dlp/yt-dlp/releases/tag/2023.11.14
CVE ID: CVE-2023-46122 State: PUBLISHED Published: 2023-10-23T15:51:02.875Z Last Updated: 2024-09-17T13:45:20.258Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: sbt Products: sbt Problem Types: CWE-22 Description: sbt is a build tool for Scala, Java, and others. Given a specially crafted zip or JAR file, `IO.unzip` allows writing of arbitrary file. This would have potential to overwrite `/root/.ssh/authorized_keys`. Within sbt's main code, `IO.unzip` is used in `pullRemoteCache` task and `Resolvers.remote`; however many projects use `IO.unzip(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7. Additional Analyst Not
p(...)` directly to implement custom tasks. This vulnerability has been patched in version 1.9.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sbt/sbt/security/advisories/GHSA-h9mw-grgx-2fhf - https://github.com/sbt/io/issues/358 - https://github.com/sbt/io/pull/360 - https://github.com/sbt/io/commit/124538348db0713c80793cb57b915f97ec13188a
CVE ID: CVE-2023-46123 State: PUBLISHED Published: 2023-10-25T00:13:00.565Z Last Updated: 2025-03-25T19:30:48.886Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: jumpserver Products: jumpserver Problem Types: CWE-307 Description: jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the Core API allows attackers to bypass password brute-force protections by spoofing arbitrary IP addresses. By exploiting this vulnerability, attackers can effectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has
ectively make unlimited password attempts by altering their apparent IP address for each request. This vulnerability has been patched in version 3.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jumpserver/jumpserver/security/advisories/GHSA-hvw4-766m-p89f - https://github.com/jumpserver/jumpserver/releases/tag/v3.8.0 - https://www.sonarsource.com/blog/diving-into-jumpserver-attackers-gateway-to-internal-networks-1-2
CVE ID: CVE-2023-46124 State: PUBLISHED Published: 2023-10-24T22:51:55.128Z Last Updated: 2024-09-11T13:21:00.478Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: ethyca Products: fides Problem Types: CWE-918 Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary
rmat. It was discovered that specially crafted YAML dataset and config files allow a malicious user to perform arbitrary requests to internal systems and exfiltrate data outside the environment (also known as a Server-Side Request Forgery). The application does not perform proper validation to block attempts to connect to internal (including localhost) resources. The vulnerability has been patched in Fides version `2.22.1`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-jq3w-9mgf-43m4 - https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee - https://github.com/ethyca/
9mgf-43m4 - https://github.com/ethyca/fides/commit/cd344d016b1441662a61d0759e7913e8228ed1ee - https://github.com/ethyca/fides/releases/tag/2.22.1
CVE ID: CVE-2023-46125 State: PUBLISHED Published: 2023-10-24T22:42:05.651Z Last Updated: 2024-09-11T13:23:33.012Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ethyca Products: fides Problem Types: CWE-200 Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data co
ed to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. The vulnerability has been patched in Fides version `2.22.1`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ed in Fides version `2.22.1`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-rjxg-rpg3-9r89 - https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06 - https://github.com/ethyca/fides/releases/tag/2.22.1
CVE ID: CVE-2023-46126 State: PUBLISHED Published: 2023-10-24T21:59:30.055Z Last Updated: 2024-09-17T14:15:58.558Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: ethyca Products: fides Problem Types: CWE-79 Description: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated webs
ad in the privacy policy URL which triggers JavaScript execution when the privacy notice is served by an integrated website. The domain scope of the executed JavaScript is that of the integrated website. Exploitation is limited to Admin UI users with the contributor role or higher. The vulnerability has been patched in Fides version `2.22.1`. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ethyca/fides/security/advisories/GHSA-fgjj-5jmr-gh83 - https://github.com/ethyca/fides/commit/3231d19699f9c895c986f6a967a64d882769c506 - https://github.com/ethyca/fides/releases/tag/2.22.1
CVE ID: CVE-2023-46127 State: PUBLISHED Published: 2023-10-23T14:29:01.888Z Last Updated: 2024-09-11T15:23:48.149Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: frappe Products: frappe Problem Types: CWE-79 Description: Frappe is a full-stack web application framework that uses Python and MariaDB on the server side and an integrated client side library. A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. This vulnerability has been patched in version 14.49.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/adviso
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/frappe/frappe/security/advisories/GHSA-j2w9-8xrr-7g98 - https://github.com/frappe/frappe/pull/22339 - https://github.com/frappe/frappe/commit/3dc5d2fcc7561dde181ba953009fe6e39d64e900
CVE ID: CVE-2023-46128 State: PUBLISHED Published: 2023-10-24T14:17:52.830Z Last Updated: 2024-09-11T17:02:05.910Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: nautobot Products: nautobot Problem Types: CWE-200 Description: Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed user passwords as stored in the database to any authenticated user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in
user with access to these endpoints. The passwords are not exposed in plaintext. This vulnerability has been patched in version 2.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nautobot/nautobot/security/advisories/GHSA-r2hw-74xv-4gqp - https://github.com/nautobot/nautobot/pull/4692 - https://github.com/nautobot/nautobot/commit/1ce8e5c658a075c29554d517cd453675e5d40d71
CVE ID: CVE-2023-46129 State: PUBLISHED Published: 2023-10-30T23:47:36.039Z Last Updated: 2025-02-27T20:38:56.583Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: nats-io Products: nkeys Problem Types: CWE-321, CWE-325 Description: NATS.io is a high performance open source pub-sub distributed communication technology, built for the cloud, on-premise, IoT, and edge computing. The cryptographic key handling library, nkeys, recently gained support for encryption, not just for signing/authentication. This is used in nats-server 2.10 (Sep 2023) and newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10
d newer for authentication callouts. In nkeys versions 0.4.0 through 0.4.5, corresponding with NATS server versions 2.10.0 through 2.10.3, the nkeys library's `xkeys` encryption handling logic mistakenly passed an array by value into an internal function, where the function mutated that buffer to populate the encryption key to use. As a result, all encryption was actually to an all-zeros key. This affects encryption only, not signing. FIXME: FILL IN IMPACT ON NATS-SERVER AUTH CALLOUT SECURITY. nkeys Go library 0.4.6, corresponding with NATS Server 2.10.4, has a patch for this issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys libra
is issue. No known workarounds are available. For any application handling auth callouts in Go, if using the nkeys library, update the dependency, recompile and deploy that in lockstep. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nats-io/nkeys/security/advisories/GHSA-mr45-rx8q-wcm9 - http://www.openwall.com/lists/oss-security/2023/10/31/1 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ULQQONMSCQSH5Z5OWFFQHCGEZ3NL4DRJ/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R3UETKPUB3V5JS5TLZOF3SMTGT5K5APS/
CVE ID: CVE-2023-46130 State: PUBLISHED Published: 2023-11-10T14:54:48.828Z Last Updated: 2024-09-03T18:57:10.938Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: discourse Products: discourse Problem Types: CWE-770 Description: Discourse is an open source platform for community discussion. Prior to version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches, some theme components allow users to add svgs with unlimited `height` attributes, and this can affect the availability of subsequent replies in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are w
in a topic. Most Discourse instances are unaffected, only instances with the svgbob or the mermaid theme component are within scope. The issue is patched in version 3.1.3 of the `stable` branch and version 3.2.0.beta3 of the `beta` and `tests-passed` branches. As a workaround, disable or remove the relevant theme components. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/discourse/discourse/security/advisories/GHSA-c876-638r-vfcg - https://github.com/discourse/discourse/commit/6183d9633de873ac2b1e9cdb6ac1c94b4ffae9cb - https://github.com/discourse/discourse/commit/89a2e60706ce22e4afc463d03af2f34c53291800
CVE ID: CVE-2023-46131 State: PUBLISHED Published: 2023-12-20T23:24:27.227Z Last Updated: 2024-08-02T20:37:39.816Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: grails Products: grails-core Problem Types: CWE-400 Description: Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails framework application using Grails data binding is vulnerable. This issue has been patched in version 3.3.17, 4.1.3, 5.3.4, 6.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/grails/grails-core/security/advisories/GHSA
nal Analyst Notes: - CVE Program Container: References: - https://github.com/grails/grails-core/security/advisories/GHSA-3pjv-r7w4-2cf5 - https://github.com/grails/grails-core/issues/13302 - https://github.com/grails/grails-core/commit/74326bdd2cf7dcb594092165e9464520f8366c60 - https://github.com/grails/grails-core/commit/c401faaa6c24c021c758b95f72304a0e855a8db3 - https://grails.org/blog/2023-12-20-cve-data-binding-dos.html
CVE ID: CVE-2023-46132 State: PUBLISHED Published: 2023-11-14T20:23:15.643Z Last Updated: 2024-08-29T20:19:53.164Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L) Vendors: hyperledger Products: fabric Problem Types: CWE-362 Description: Hyperledger Fabric is an open source permissioned distributed ledger framework. Combining two molecules to one another, called "cross-linking" results in a molecule with a chemical formula that is composed of all atoms of the original two molecules. In Fabric, one can take a block of transactions and cross-link the transactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second
nsactions in a way that alters the way the peers parse the transactions. If a first peer receives a block B and a second peer receives a block identical to B but with the transactions being cross-linked, the second peer will parse transactions in a different way and thus its world state will deviate from the first peer. Orderers or peers cannot detect that a block has its transactions cross-linked, because there is a vulnerability in the way Fabric hashes the transactions of blocks. It simply and naively concatenates them, which is insecure and lets an adversary craft a "cross-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, i
oss-linked block" (block with cross-linked transactions) which alters the way peers process transactions. For example, it is possible to select a transaction and manipulate a peer to completely avoid processing it, without changing the computed hash of the block. Additional validations have been added in v2.2.14 and v2.5.5 to detect potential cross-linking issues before processing blocks. Users are advised to upgrade. There are no known workarounds for this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/hyperledger/fabric/security/advisories/GHSA-v9w2-543f-h69m