rainbutterfly/cve_corpus huggingface dataset:
CVE-2023-31006 IBM Security Access Manager Container denial of service
IBM Security Access Manager Container (IBM Security Verify Access Appliance 10.0.0.0 through 10.0.6.1 and IBM Security Verify Access Docker 10.0.0.0 through 10.0.6.1) is vulnerable to a denial of service attacks on the DSC server.  IBM X-Force ID:  254776.
Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: IBM
product: Security Verify Access Appliance
default_status: unaffected
vendor: IBM
product: Security Verify Access Docker
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2024-02-03T01:05:14.622Z
CVE-2023-31007 Apache Pulsar: Broker does not always disconnect client when authentication data expires
Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a client connects directly to a broker with a specially crafted connect command when the broker is configured with authenticateOriginalAuthData=false.

This issue affects Apache Pulsar: through 2.9.4, from 2.10.0 through 2.10.3, 2.11.0.

2.9 Pulsar Broker users should upgrade to at least 2.9.5.
2.10 Pulsar Broker users should upgrade to at least 2.10.4.
2.11 Pulsar Broker users should upgrade to at least 2.11.1.
3.0 Pulsar Broker users are unaffected.
Any users running the Pulsar Broker for 2.8.* and earlier should upgrade to one of the above patched versions.

Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Apache Software Foundation
product: Apache Pulsar
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 0
baseSeverity: NONE
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N
version: 3.1
Credits: lang: en
value: Michael Marshall of DataStax
Published: 2023-07-12T09:07:03.227Z
CVE-2023-31008 
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of services, escalation of privileges, and information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2023-09-20T00:55:51.353Z
CVE-2023-31009 
NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
version: 3.1
Published: 2023-09-20T00:56:53.278Z
CVE-2023-31010 
NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, and denial of service.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 6.8
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-09-20T01:02:23.410Z
CVE-2023-31011 
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 5.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:N
version: 3.1
Published: 2023-09-20T01:03:34.483Z
CVE-2023-31012 
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-09-20T01:05:52.001Z
CVE-2023-31013 
NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. A successful exploit of this vulnerability may lead to escalation of privileges and information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
version: 3.1
Published: 2023-09-20T01:06:36.824Z
CVE-2023-31014 
NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can process the implicit intent meant for the streamer component. A successful exploit of this vulnerability may lead to limited information disclosure, denial of service, and code execution.
Problem types: cwe_id: CWE-927
description: CWE-927
Affected products: vendor: NVIDIA
product: GeForce NOW for Android mobile and TV app
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
version: 3.1
Published: 2023-09-20T01:13:46.226Z
CVE-2023-31015 
NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. A successful exploit of this vulnerability may lead to escalation of privileges, information disclosure, code execution, and denial of service.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: NVIDIA
product: DGX H100 BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
version: 3.1
Published: 2023-09-20T01:12:02.303Z
CVE-2023-31016 CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 7.3
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-02T18:36:43.382Z
CVE-2023-31017 CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability where an attacker may be able to write arbitrary data to privileged locations by using reparse points. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
Problem types: cwe_id: CWE-552
description: CWE-552
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-02T18:56:19.822Z
CVE-2023-31018 CVE
NVIDIA GPU Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a NULL-pointer dereference, which may lead to denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: nvidia
product: vGPU driver and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2023-11-02T18:56:20.305Z
CVE-2023-31019 CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in wksServicePlugin.dll, where the driver implementation does not restrict or incorrectly restricts access from the named pipe server to a connecting client, which may lead to potential impersonation to the client's secure context.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 7.8
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-11-02T18:56:20.769Z
CVE-2023-31020 CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause improper access control, which may lead to denial of service or data tampering.
Problem types: cwe_id: CWE-284
description: CWE-284
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 6.1
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
version: 3.1
Published: 2023-11-02T18:56:21.202Z
CVE-2023-31021 CVE
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a malicious user in the guest VM can cause a NULL-pointer dereference, which may lead to denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: nvidia
product: vGPU driver and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-11-02T18:56:21.642Z
CVE-2023-31022 CVE
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a NULL-pointer dereference may lead to denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-11-02T18:56:22.082Z
CVE-2023-31023 CVE
NVIDIA Display Driver for Windows contains a vulnerability where an attacker may cause a pointer dereference of an untrusted value, which may lead to denial of service.
Problem types: cwe_id: CWE-822
description: CWE-822
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2023-11-02T18:56:22.518Z
CVE-2023-31024 CVE
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause stack memory corruption by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 9
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T18:31:35.602Z
CVE-2023-31025 CVE
NVIDIA DGX A100 BMC contains a vulnerability where an attacker may cause an LDAP user injection. A successful exploit of this vulnerability may lead to information disclosure.
Problem types: cwe_id: CWE-90
description: CWE-90
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 6.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Published: 2024-01-12T18:31:42.575Z
CVE-2023-31026 CVE
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where a NULL-pointer dereference may lead to denial of service.
Problem types: cwe_id: CWE-476
description: CWE-476
Affected products: vendor: nvidia
product: vGPU driver and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
Published: 2023-11-02T18:56:22.940Z
CVE-2023-31027 CVE
NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administrator is updating GPU drivers, which may lead to escalation of privileges.
Problem types: cwe_id: CWE-427
description: CWE-427
Affected products: vendor: nvidia
product: NVIDIA GPU Display driver, vGPU driver, and Cloud gaming driver
default_status: unaffected
CVSS v3.1: baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
version: 3.1
Published: 2023-11-02T18:56:23.410Z
CVE-2023-31028 

NVIDIA nvJPEG2000 Library for Windows and Linux contains a vulnerability where improper input validation might enable an attacker to use a specially crafted input file. A successful exploit of this vulnerability might lead to a partial denial of service.


Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: NVIDIA
product: nvJPEG2000 Library
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 2.8
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
version: 3.1
Published: 2024-04-05T17:46:33.082Z
CVE-2023-31029 CVE
NVIDIA DGX A100 baseboard management controller (BMC) contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 9.3
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T18:31:32.801Z
CVE-2023-31030 CVE
NVIDIA DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a stack overflow by sending a specially crafted network packet. A successful exploit of this vulnerability may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.
Problem types: cwe_id: CWE-121
description: CWE-121
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 9.3
baseSeverity: CRITICAL
vectorString: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T18:31:34.210Z
CVE-2023-31031 CVE
NVIDIA DGX Station A100 and DGX Station A800 SBIOS contains a vulnerability where a user may cause a heap-based buffer overflow by local access. A successful exploit of this vulnerability may lead to code execution, denial of service, information disclosure, and data tampering.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: LOW
baseScore: 4.2
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2024-01-12T18:31:44.171Z
CVE-2023-31032 CVE
NVIDIA DGX A100 SBIOS contains a vulnerability where a user may cause a dynamic variable evaluation by local access. A successful exploit of this vulnerability may lead to denial of service.
Problem types: cwe_id: CWE-627
description: CWE-627
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T18:31:36.994Z
CVE-2023-31033 CVE
NVIDIA DGX A100 BMC contains a vulnerability where a user may cause a missing authentication issue for a critical function by an adjacent network . A successful exploit of this vulnerability may lead to escalation of privileges, code execution, denial of service, information disclosure, and data tampering.
Problem types: cwe_id: CWE-306
description: CWE-306
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 6.8
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T18:31:39.794Z
CVE-2023-31034 CVE
NVIDIA DGX A100 SBIOS contains a vulnerability where a local attacker can cause input validation checks to be bypassed by causing an integer overflow. A successful exploit of this vulnerability may lead to denial of service, information disclosure, and data tampering.
Problem types: cwe_id: CWE-190
description: CWE-190
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 6.6
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:H
version: 3.1
Published: 2024-01-12T18:31:41.194Z
CVE-2023-31035 CVE
NVIDIA DGX A100 SBIOS contains a vulnerability where an attacker may cause an SMI callout vulnerability that could be used to execute arbitrary code at the SMM level. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, and information disclosure.
Problem types: cwe_id: CWE-20
description: CWE-20
Affected products: vendor: nvidia
product: DGX A100
default_status: unaffected
CVSS v3.1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T18:31:38.411Z
CVE-2023-31036 CVE
NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where, when it is launched with the non-default command line option --model-control explicit, an attacker may use the model load API to cause a relative path traversal. A successful exploit of this vulnerability may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Problem types: cwe_id: CWE-23
description: CWE-23
Affected products: vendor: nvidia
product: Triton Inference Server
default_status: unaffected
CVSS v3.1: baseScore: 7.5
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-12T17:11:38.579Z
CVE-2023-31037 

NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network call. A successful exploit of this vulnerability may lead to code execution on the OS.


Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: NVIDIA
product: Bluefield 2 DPU BMC, BlueField 3 DPU BMC
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.2
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2024-01-24T02:12:30.123Z
CVE-2023-31038 Apache Log4cxx: SQL injection when using ODBC appender
SQL injection in Log4cxx when using the ODBC appender to send log messages to a database.  No fields sent to the database were properly escaped for SQL injection.  This has been the case since at least version 0.9.0(released 2003-08-06)




Note that Log4cxx is a C++ framework, so only C++ applications are affected.

Before version 1.1.0, the ODBC appender was automatically part of Log4cxx if the library was found when compiling the library.  As of version 1.1.0, this must be both explicitly enabled in order to be compiled in.




Three preconditions must be met for this vulnerability to be possible:

1. Log4cxx compiled with ODBC support(before version 1.1.0, this was auto-detected at compile time)

2. ODBCAppender enabled for logging messages to, generally done via a config file

3. User input is logged at some point. If your application does not have user input, it is unlikely to be affected.





Users are recommended to upgrade to version 1.1.0 which properly binds the parameters to the SQL statement, or migrate to the new DBAppender class which supports an ODBC connection in addition to other databases. 
Note that this fix does require a configuration file update, as the old configuration files will not configure properly.  An example is shown below, and more information may be found in the Log4cxx documentation on the ODBCAppender.





Example of old configuration snippet:

<appender name="SqlODBCAppender" class="ODBCAppender">

    <param name="sql" value="INSERT INTO logs (message) VALUES ('%m')" />

    ... other params here ...

</appender>




The migrated configuration snippet with new ColumnMapping parameters:


<appender name="SqlODBCAppender" class="ODBCAppender">




    <param name="sql" value="INSERT INTO logs (message) VALUES (?)" />

    <param name="ColumnMapping" value="message"/>
    ... other params here ...


</appender>






Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: Apache Software Foundation
product: Apache Log4cxx
default_status: unaffected
Published: 2023-05-08T08:54:10.234Z