Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2020-25563 State: PUBLISHED Published: 2021-08-11T20:21:57 Last Updated: 2024-08-04T15:33:05.750Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SapphireIMS 5.0, it is possible to create local administrator on any client without requiring any credentials by directly accessing RemoteMgmtTaskSave (Automation Tasks) feature and not having a JSESSIONID. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25563-sapphireims-unauthenticated-remote-command-execution-create-local-admin-on-clients/
CVE ID: CVE-2020-25564 State: PUBLISHED Published: 2021-08-11T20:22:55 Last Updated: 2024-08-04T15:33:05.751Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SapphireIMS 5.0, it is possible to create local administrator on any client with credentials of a non-privileged user by directly accessing RemoteMgmtTaskSave (Automation Tasks) feature. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25564-sapphireims-unprivileged-user-remote-command-execution-create-local-admin-on-clients/
CVE ID: CVE-2020-25565 State: PUBLISHED Published: 2021-08-11T20:23:49 Last Updated: 2024-08-04T15:33:05.770Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SapphireIMS 5.0, it is possible to use the hardcoded credential in clients (username: sapphire, password: ims) and gain access to the portal. Once the access is available, the attacker can inject malicious OS commands on “ping”, “traceroute” and “snmp” functions and execute code on the server. Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25565-sapphireims-unprivileged-user-remote-command-execution-on-serv
- https://vuln.shellcoder.party/2020/09/19/cve-2020-25565-sapphireims-unprivileged-user-remote-command-execution-on-server/
CVE ID: CVE-2020-25566 State: PUBLISHED Published: 2021-08-11T20:24:56 Last Updated: 2024-08-04T15:33:05.666Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SapphireIMS 5.0, it is possible to take over an account by sending a request to the Save_Password form as shown in POC. Notice that we do not require a JSESSIONID in this request and can reset any user’s password by changing the username to that user and password to base64(desired password). Additional Analyst Notes: - CVE Program Container: References: - https://vuln.shellcoder.party/tags/sapphireims/ - https://vuln.shellcoder.party/2020/09/19/cve-2020-25566-sapphireims-unauthenticated-account-takeover/
CVE ID: CVE-2020-25573 State: PUBLISHED Published: 2020-09-14T18:16:30 Last Updated: 2024-08-04T15:33:05.767Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the linked-hash-map crate before 0.5.3 for Rust. It creates an uninitialized NonNull pointer, which violates a non-null constraint. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2020-0026.html - https://github.com/contain-rs/linked-hash-map/pull/100
CVE ID: CVE-2020-25574 State: PUBLISHED Published: 2020-09-14T18:16:17 Last Updated: 2024-08-04T15:33:05.690Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the http crate before 0.1.20 for Rust. An integer overflow in HeaderMap::reserve() could result in denial of service (e.g., an infinite loop). Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0033.html - https://github.com/hyperium/http/issues/352
CVE ID: CVE-2020-25575 State: PUBLISHED Published: 2020-09-14T18:15:48 Last Updated: 2024-08-04T15:33:05.684Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type confusion flaw when downcasting. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. NOTE: This may overlap CVE-2019-25010 Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/rust-lang-nursery/failure/issues/336 - https://rustsec.org/advisories/RUSTSEC-2020-0036.html - https://boats.
github.com/rust-lang-nursery/failure/issues/336 - https://rustsec.org/advisories/RUSTSEC-2020-0036.html - https://boats.gitlab.io/blog/post/failure-to-fehler/
CVE ID: CVE-2020-25576 State: PUBLISHED Published: 2020-09-14T18:16:00 Last Updated: 2024-08-04T15:33:05.759Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in the rand_core crate before 0.4.2 for Rust. Casting of byte slices to integer slices mishandles alignment constraints. Additional Analyst Notes: - CVE Program Container: References: - https://rustsec.org/advisories/RUSTSEC-2019-0035.html
CVE ID: CVE-2020-25577 State: PUBLISHED Published: 2021-03-29T19:53:50 Last Updated: 2024-08-04T15:33:05.753Z Vendors: n/a Products: FreeBSD Problem Types: Improper validation Description: In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 rtsold(8) does not verify that the RDNSS option does not extend past the end of the received packet before processing its contents. While the kernel currently ignores such malformed packets, it passes them to userspace programs. Any programs expecting the kernel to do validation may be vulnerable to an overflow. Additional Analyst Notes: - CVE Program Container: Refe
ng the kernel to do validation may be vulnerable to an overflow. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc - https://security.netapp.com/advisory/ntap-20210423-0001/
CVE ID: CVE-2020-25578 State: PUBLISHED Published: 2021-03-26T20:44:43 Last Updated: 2024-08-04T15:33:05.687Z Vendors: n/a Products: FreeBSD Problem Types: Improper initialization Description: In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 several file systems were not properly initializing the d_off field of the dirent structures returned by VOP_READDIR. In particular, tmpfs(5), smbfs(5), autofs(5) and mqueuefs(5) were failing to do so. As a result, eight uninitialized kernel stack bytes may be leaked to userspace by these file systems. Additional Analyst Notes: - CVE Program Container: References
ck bytes may be leaked to userspace by these file systems. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc - https://security.netapp.com/advisory/ntap-20210423-0002/
CVE ID: CVE-2020-25579 State: PUBLISHED Published: 2021-03-26T20:44:53 Last Updated: 2024-08-04T15:33:05.677Z Vendors: n/a Products: FreeBSD Problem Types: Improper initialization Description: In FreeBSD 12.2-STABLE before r368969, 11.4-STABLE before r369047, 12.2-RELEASE before p3, 12.1-RELEASE before p13 and 11.4-RELEASE before p7 msdosfs(5) was failing to zero-fill a pair of padding fields in the dirent structure, resulting in a leak of three uninitialized bytes. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:01.fsdisclosure.asc - https://security.netapp.com/advisory/ntap-20210423-0002/
CVE ID: CVE-2020-25580 State: PUBLISHED Published: 2021-03-26T20:38:30 Last Updated: 2024-08-04T15:33:05.683Z Vendors: n/a Products: FreeBSD Problem Types: Missing authorization Description: In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:03.pam_login_access.asc - https://security.netapp.com/advisory/ntap-20210423-0005/
CVE ID: CVE-2020-25581 State: PUBLISHED Published: 2021-03-26T20:40:56 Last Updated: 2024-08-04T15:33:05.769Z Vendors: n/a Products: FreeBSD Problem Types: Race Condition Description: In FreeBSD 12.2-STABLE before r369312, 11.4-STABLE before r369313, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 due to a race condition in the jail_remove(2) implementation, it may fail to kill some of the processes. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:04.jail_remove.asc - https://security.netapp.com/advisory/ntap-20210423-0006/
CVE ID: CVE-2020-25582 State: PUBLISHED Published: 2021-03-26T20:41:04 Last Updated: 2024-08-04T15:33:05.761Z Vendors: n/a Products: FreeBSD Problem Types: Improper check for unusual conditions Description: In FreeBSD 12.2-STABLE before r369334, 11.4-STABLE before r369335, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 when a process, such as jexec(8) or killall(1), calls jail_attach(2) to enter a jail, the jailed root can attach to it using ptrace(2) before the current working directory is changed. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc - https://security.netapp.com/advisory/ntap-20210423-00
/security.FreeBSD.org/advisories/FreeBSD-SA-21:05.jail_chdir.asc - https://security.netapp.com/advisory/ntap-20210423-0003/
CVE ID: CVE-2020-25583 State: PUBLISHED Published: 2021-03-29T19:53:57 Last Updated: 2024-08-04T15:33:05.760Z Vendors: n/a Products: FreeBSD Problem Types: Out-of-bounds write Description: In FreeBSD 12.2-STABLE before r368250, 11.4-STABLE before r368253, 12.2-RELEASE before p1, 12.1-RELEASE before p11 and 11.4-RELEASE before p5 when processing a DNSSL option, rtsold(8) decodes domain name labels per an encoding specified in RFC 1035 in which the first octet of each label contains the label's length. rtsold(8) did not validate label lengths correctly and could overflow the destination buffer. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/adviso
destination buffer. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-20:32.rtsold.asc - https://security.netapp.com/advisory/ntap-20210423-0004/
CVE ID: CVE-2020-25584 State: PUBLISHED Published: 2021-04-07T14:43:26 Last Updated: 2024-08-04T15:33:05.696Z Vendors: n/a Products: FreeBSD Problem Types: Time-of-check Time-of-use Race Condition Description: In FreeBSD 13.0-STABLE before n245118, 12.2-STABLE before r369552, 11.4-STABLE before r369560, 13.0-RC5 before p1, 12.2-RELEASE before p6, and 11.4-RELEASE before p9, a superuser inside a FreeBSD jail configured with the non-default allow.mount permission could cause a race condition between the lookup of ".." and remounting a filesystem, allowing access to filesystem hierarchy outside of the jail. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBS
hierarchy outside of the jail. Additional Analyst Notes: - CVE Program Container: References: - https://security.FreeBSD.org/advisories/FreeBSD-SA-21:10.jail_mount.asc - https://security.netapp.com/advisory/ntap-20210423-0009/
CVE ID: CVE-2020-25585 State: REJECTED Published: 2022-07-07T19:31:17 Last Updated: 2022-07-07T19:31:17 Description: No description available.
CVE ID: CVE-2020-25586 State: REJECTED Published: 2022-07-07T19:31:22 Last Updated: 2022-07-07T19:31:22 Description: No description available.
CVE ID: CVE-2020-25587 State: REJECTED Published: 2022-07-07T19:31:25 Last Updated: 2022-07-07T19:31:25 Description: No description available.
CVE ID: CVE-2020-25588 State: REJECTED Published: 2022-07-07T19:31:28 Last Updated: 2022-07-07T19:31:28 Description: No description available.
CVE ID: CVE-2020-25589 State: REJECTED Published: 2022-07-07T19:31:34 Last Updated: 2022-07-07T19:31:34 Description: No description available.
CVE ID: CVE-2020-25590 State: REJECTED Published: 2022-07-07T19:31:39 Last Updated: 2022-07-07T19:31:39 Description: No description available.
CVE ID: CVE-2020-25591 State: REJECTED Published: 2022-07-07T19:31:42 Last Updated: 2022-07-07T19:31:42 Description: No description available.
CVE ID: CVE-2020-25592 State: PUBLISHED Published: 2020-11-06T07:31:53 Last Updated: 2024-08-04T15:33:05.711Z Vendors: n/a Products: n/a Problem Types: n/a Description: In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH. Additional Analyst Notes: - CVE Program Container: References: - https://docs.saltstack.com/en/latest/topics/releases/index.html - https://www.saltstack.com/blog/on-november-3-2020-saltstack-publicly-disclosed-three-new-cves/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ - http://lists.opensuse
chives/list/package-announce%40lists.fedoraproject.org/message/TPOGB2F6XUAIGFDTOCQDNB2VIXFXHWMA/ - http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00029.html - https://security.gentoo.org/glsa/202011-13 - http://packetstormsecurity.com/files/160039/SaltStack-Salt-REST-API-Arbitrary-Command-Execution.html - https://lists.debian.org/debian-lts-announce/2020/12/msg00007.html - https://www.debian.org/security/2021/dsa-4837
CVE ID: CVE-2020-25593 State: PUBLISHED Published: 2021-07-15T14:07:55 Last Updated: 2024-08-04T15:33:05.801Z Vendors: n/a Products: n/a Problem Types: n/a Description: Acronis True Image through 2021 on macOS allows local privilege escalation from admin to root due to insecure folder permissions. Additional Analyst Notes: - CVE Program Container: References: - https://www.acronis.com/en-us/blog/ - https://kb.acronis.com/content/68396
CVE ID: CVE-2020-25594 State: PUBLISHED Published: 2021-02-01T15:41:36 Last Updated: 2024-08-04T15:33:05.746Z Vendors: n/a Products: n/a Problem Types: n/a Description: HashiCorp Vault and Vault Enterprise allowed for enumeration of Secrets Engine mount paths via unauthenticated HTTP requests. Fixed in 1.6.2 & 1.5.7. Additional Analyst Notes: - CVE Program Container: References: - https://discuss.hashicorp.com/t/hcsec-2021-03-vault-api-endpoint-allowed-enumeration-of-secrets-engine-mount-paths-without-authentication/20336 - https://security.gentoo.org/glsa/202207-01
CVE ID: CVE-2020-25595 State: PUBLISHED Published: 2020-09-23T21:01:30 Last Updated: 2024-08-04T15:33:05.682Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x. The PCI passthrough code improperly uses register data. Code paths in Xen's MSI handling have been identified that act on unsanitized values read back from device hardware registers. While devices strictly compliant with PCI specifications shouldn't be able to affect these registers, experience shows that it's very common for devices to have out-of-spec "backdoor" operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen, leading to
r" operations that can affect the result of these reads. A not fully trusted guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. Privilege escalation and information leaks cannot be excluded. All versions of Xen supporting PCI passthrough are affected. Only x86 systems are vulnerable. Arm systems are not vulnerable. Only guests with passed through PCI devices may be able to leverage the vulnerability. Only systems passing through devices with out-of-spec ("backdoor") functionality can cause issues. Experience shows that such out-of-spec functionality is common; unless you have reason to believe that your device does not have such functionality, it's be
ec functionality is common; unless you have reason to believe that your device does not have such functionality, it's better to assume that it does. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-337.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/ - https://www.debian.org/security/2020/dsa-4769 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html - https://lists.fedoraproject.org/archives/list/p
://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/ - https://security.gentoo.org/glsa/202011-06
CVE ID: CVE-2020-25596 State: PUBLISHED Published: 2020-09-23T21:28:21 Last Updated: 2024-08-04T15:33:05.762Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x. x86 PV guest kernels can experience denial of service via SYSENTER. The SYSENTER instruction leaves various state sanitization activities to software. One of Xen's sanitization paths injects a #GP fault, and incorrectly delivers it twice to the guest. This causes the guest kernel to observe a kernel-privilege #GP fault (typically fatal) rather than a user-privilege #GP fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel, resulting
ege #GP fault (usually converted into SIGSEGV/etc.). Malicious or buggy userspace can crash the guest kernel, resulting in a VM Denial of Service. All versions of Xen from 3.2 onwards are vulnerable. Only x86 systems are vulnerable. ARM platforms are not vulnerable. Only x86 systems that support the SYSENTER instruction in 64bit mode are vulnerable. This is believed to be Intel, Centaur, and Shanghai CPUs. AMD and Hygon CPUs are not believed to be vulnerable. Only x86 PV guests can exploit the vulnerability. x86 PVH / HVM guests cannot exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-339.html - https://lists.fedo
Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-339.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/ - https://www.debian.org/security/2020/dsa-4769 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/ - https://security.gentoo.org/glsa/202011-06
CVE ID: CVE-2020-25597 State: PUBLISHED Published: 2020-09-23T21:05:39 Last Updated: 2024-08-04T15:33:05.700Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen through 4.14.x. There is mishandling of the constraint that once-valid event channels may not turn invalid. Logic in the handling of event channel operations in Xen assumes that an event channel, once valid, will not become invalid over the life time of a guest. However, operations like the resetting of all event channels may involve decreasing one of the bounds checked when determining validity. This may lead to bug checks triggering, crashing the host. An unprivileged guest may be able to cras
termining validity. This may lead to bug checks triggering, crashing the host. An unprivileged guest may be able to crash Xen, leading to a Denial of Service (DoS) for the entire system. All Xen versions from 4.4 onwards are vulnerable. Xen versions 4.3 and earlier are not vulnerable. Only systems with untrusted guests permitted to create more than the default number of event channels are vulnerable. This number depends on the architecture and type of guest. For 32-bit x86 PV guests, this is 1023; for 64-bit x86 PV guests, and for all ARM guests, this number is 4095. Systems where untrusted guests are limited to fewer than this number are not vulnerable. Note that xl and libxl limit max_even
s where untrusted guests are limited to fewer than this number are not vulnerable. Note that xl and libxl limit max_event_channels to 1023 by default, so systems using exclusively xl, libvirt+libxl, or their own toolstack based on libxl, and not explicitly setting max_event_channels, are not vulnerable. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-338.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/ - https://www.debi
rg/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/ - https://www.debian.org/security/2020/dsa-4769 - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/ - https://security.gentoo.org/glsa/202011-06
CVE ID: CVE-2020-25598 State: PUBLISHED Published: 2020-09-23T21:07:44 Last Updated: 2024-08-04T15:33:05.766Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue was discovered in Xen 4.14.x. There is a missing unlock in the XENMEM_acquire_resource error path. The RCU (Read, Copy, Update) mechanism is a synchronisation primitive. A buggy error path in the XENMEM_acquire_resource exits without releasing an RCU reference, which is conceptually similar to forgetting to unlock a spinlock. A buggy or malicious HVM stubdomain can cause an RCU reference to be leaked. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Serv
d. This causes subsequent administration operations, (e.g., CPU offline) to livelock, resulting in a host Denial of Service. The buggy codepath has been present since Xen 4.12. Xen 4.14 and later are vulnerable to the DoS. The side effects are believed to be benign on Xen 4.12 and 4.13, but patches are provided nevertheless. The vulnerability can generally only be exploited by x86 HVM VMs, as these are generally the only type of VM that have a Qemu stubdomain. x86 PV and PVH domains, as well as ARM VMs, typically don't use a stubdomain. Only VMs using HVM stubdomains can exploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability.
ploit the vulnerability. VMs using PV stubdomains, or with emulators running in dom0, cannot exploit the vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://xenbits.xen.org/xsa/advisory-334.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4JRXMKEMQRQYWYEPHVBIWUEAVQ3LU4FN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DA633Y3G5KX7MKRN4PFEGM3IVTJMBEOM/ - http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6T
s://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RJZERRBJN6E6STDCHT4JHP4MI6TKBCJE/ - https://security.gentoo.org/glsa/202011-06