Blueprints that have vulnerabilities with a CVSS score >= 9.0 and meet the following criteria should submit their information in the chart below to have the vulnerability considered for an exception:

  • Running at least the minimum OS version required by the Akraino Security Sub-Committee
    • Ubuntu
    • CentOS
    • Debian
    • Fedora
    • Suse Enterprise Server

Legend

Priority/Score Descriptions

Not VulnerablePackages which do not exist in the archive, are not affected by the vulnerability or have a fix applied in the archive.
PendingA fix has been applied and updated packages are awaiting arrival into the archive. For example, this might be used when wider testing is requested for the updated package.
UnknownOpen vulnerability where the priority is currently unknown and needs to be triaged.
NegligibleOpen vulnerability that may be a problem but otherwise does not impose a security risk due to various factors. Examples include when the vulnerability is only theoretical in nature, requires a very special situation, has almost no install base or does no real damage. These typically will not receive security updates unless there is an easy fix and some other issue causes an update.
LowOpen vulnerability that is a problem but does very little damage or is otherwise hard to exploit due to small user base or other factors such as requiring specific environment, uncommon configuration, user assistance, etc. These tend to be included in security updates only when higher priority issues require an update or if many low priority issues have built up.
MediumOpen vulnerability that is a real problem and is exploitable for many users of the affected software. Examples include network daemon denial of service, cross-site scripting and gaining user privileges.
HighOpen vulnerability that is a real problem and is exploitable for many users in the default configuration of the affected software. Examples include serious remote denial of service of the system, local root privilege escalations or local data theft.
CriticalOpen vulnerability that is a world-burning problem and is exploitable for most Ubuntu users. Examples include remote root privilege escalations or remote data theft.
CVE/KHV #BlueprintBlueprint OS/VerURL Showing OS Patch Not AvailableContact NameContact EmailCommentVendor CVSS ScoreVendor Patch AvailableException Status

CVE-2016-1585

Robot basic architecture based on SSES

Raspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2016-1585

Inoue Reo 

inoue.reo@fujitsu.com

NoApproved

CVE-2017-18201

Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2017-17479

Inoue Reo

inoue.reo@fujitsu.com

NoApproved
CVE-2019-17041 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2019-17041Inoue Reoinoue.reo@fujitsu.com

Please add to the "Vendor Patch Available" column output from the following commands:

lsb_release -a
dpkg -l | grep <package name associated with CVE>


I installed a later version of the software than the version that has been fixed for CVE.


$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 11 (bullseye)
Release:        11
Codename:       bullseye

$ dpkg -l |grep rsyslog
ii  rsyslog                              8.2102.0-2+deb11u1               arm64        reliable system and kernel logging daemon

Approved
CVE-2019-17042 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2019-17042Inoue Reoinoue.reo@fujitsu.com

Please add to the "Vendor Patch Available" column output from the following commands:

lsb_release -a
dpkg -l | grep <package name associated with CVE>


I installed a later version of the software than the version that has been fixed for CVE.


$ lsb_release -a
No LSB modules are available.
Distributor ID: Debian
Description:    Debian GNU/Linux 11 (bullseye)
Release:        11
Codename:       bullseye

$ dpkg -l |grep rsyslog
ii  rsyslog                              8.2102.0-2+deb11u1               arm64        reliable system and kernel logging daemon

Approved
CVE-2022-3649 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2022-3649Inoue Reoinoue.reo@fujitsu.com

NoApproved
CVE-2019-20433 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2019-20433Inoue Reoinoue.reo@fujitsu.com

NoApproved
CVE-2022-24303 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2022-24303Inoue Reoinoue.reo@fujitsu.com

NoApproved
CVE-2022-39319 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2022-39319

Inoue Reo

inoue.reo@fujitsu.com

No
CVE-2022-41877 Robot basic architecture based on SSESRaspberry Pi OS(Debian 11)https://security-tracker.debian.org/tracker/CVE-2022-41877Inoue Reoinoue.reo@fujitsu.com

NoApproved

CVE-2016-1585

Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2016-1585

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2017-18201Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2017-18201

Inoue Reo

inoue.reo@fujitsu.com
LowNoApproved
CVE-2017-7827Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2017-7827

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2018-5090Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2018-5090

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2018-5126Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2018-5126

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2018-5145Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2018-5145

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2018-5151Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2018-5151

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2019-17041Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2019-17041

Inoue Reo

inoue.reo@fujitsu.com
LowNoApproved
CVE-2019-17042Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2019-17042

Inoue Reo

inoue.reo@fujitsu.com
LowNoApproved
CVE-2022-0318Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2022-0318

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2022-3649Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2022-3649

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2022-3890Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2022-3890

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2022-4135Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2022-4135

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2016-9180Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2016-9180

Inoue Reo

inoue.reo@fujitsu.com
LowNoApproved
CVE-2019-20433Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2019-20433

Inoue Reo

inoue.reo@fujitsu.com
LowNoApproved
CVE-2022-24303Robot basic architecture based on SSESUbuntu 18.04https://ubuntu.com/security/CVE-2022-24303

Inoue Reo

inoue.reo@fujitsu.com
LowNoApproved
CVE-2016-1585Robot basic architecture based on SSESUbuntu 22.04https://ubuntu.com/security/CVE-2016-1585

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2022-3649Robot basic architecture based on SSESUbuntu 22.04https://ubuntu.com/security/CVE-2022-3649

Inoue Reo

inoue.reo@fujitsu.com
MediumNoApproved
CVE-2016-1585Smart Data Transaction for CPSUbuntu 20.04https://ubuntu.com/security/CVE-2016-1585

Colin Peters 

colin.peters@fujitsu.com
MediumNoApproved
CVE-2022-0318Smart Data Transaction for CPSUbuntu 20.04https://ubuntu.com/security/CVE-2022-0318

Colin Peters 

colin.peters@fujitsu.com
MediumNoApproved
CVE-2022-3643Smart Data Transaction for CPSUbuntu 20.04https://ubuntu.com/security/CVE-2022-3643

Colin Peters 

colin.peters@fujitsu.com
MediumNoApproved
CVE-2022-3649Smart Data Transaction for CPSUbuntu 20.04https://ubuntu.com/security/CVE-2022-3649

Colin Peters 

colin.peters@fujitsu.com
MediumNoApproved
CVE-2022-44640IEC Type 5: SmartNIC for Integrated Edge Cloud (IEC) Blueprint FamilyUbuntu 20.04https://ubuntu.com/security/CVE-2022-44640jin peng jinpeng@socnoc.ai
MediumNoApproved

CVE-2022-37434

CFN (Computing Force Network) Ubiquitous Computing Force Scheduling - Akraino - Akraino ConfluenceCentoOS 7.6CVE-2022-37434- Red Hat Customer Portal

hanyu ding 

dinghanyu@chinamobile.com

13366022056@163.com 


9.8Not fixed in centos 7.xApproved
CVE-2015-4042CFN (Computing Force Network) Ubiquitous Computing Force Scheduling - Akraino - Akraino ConfluenceCentoOS 7.6CVE-2015-4042- Red Hat Customer Portalhanyu ding 

dinghanyu@chinamobile.com

13366022056@163.com 


9.8Not fixed yet in centos 7.xApproved
CVE-2014-9939 CFN (Computing Force Network) Ubiquitous Computing Force Scheduling - Akraino - Akraino ConfluenceCentoOS 7.6CVE-2014-9939- Red Hat Customer Portalhanyu ding 

dinghanyu@chinamobile.com

13366022056@163.com 


9.8Not fixed yet in centos 7.xApproved


  • No labels