Covered by 2 outlets — first reported by CISA Advisories, Nov 9, 12:00 UTC
CISA Adds Four Known Exploited Vulnerabilities to Catalog
MentionsOpenSSH
In brief
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: Below are the flaws added to the catalog: The first issue…
From Security Affairs's coverage.
Continue reading
2 outlets, in the order they reported it.
CISA AdvisoriesFirst report
CISA Adds Four Known Exploited Vulnerabilities to Catalog
CISA has added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation.
Security Affairs
U.S. CISA adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds IBM, SignalWire FreeSwitch, OpenSSH, and GPUStack flaws to its Known Exploited Vulnerabilities catalog. The U.S.
Explained
The technology and terms in this story. Learn more
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- TechnologyOpenSSHThe most widely used SSH implementation, shipped with Linux, macOS and Windows.
- ConceptCISA · Cybersecurity and Infrastructure Security AgencyThe US government's cybersecurity agency, which issues alerts and runs the KEV catalog.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-287Improper AuthenticationThe system doesn't properly prove who a user is, so attackers get in as someone else.
- CWE-290Authentication Bypass by SpoofingThe system trusts something an attacker can fake, such as a source address or header.
- CWE-346Origin Validation ErrorThe software doesn't verify where a message really came from, so forged messages are trusted.
- CWE-394Unexpected Status Code or Return Value