Publish Advisories

GHSA-2m5h-jr5p-fjc8 GHSA-2pf3-qwcm-2m4r GHSA-6f46-73v7-w4mr GHSA-g36v-w2xm-r289 GHSA-jp64-jgv4-9vfq GHSA-p745-hrr6-rg8c GHSA-vrwm-pjh8-xjgm
2026-05-22 18:04:22 -07:00 · 2025-05-28 00:32:24 +00:00
parent a2c825f4c9
commit a1f6bedac0
7 changed files with 229 additions and 0 deletions
@@ -0,0 +1,34 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2m5h-jr5p-fjc8",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2024-11185"
+  ],
+  "details": "On affected platforms running Arista EOS, ingress traffic on Layer 2 ports may, under certain conditions, be improperly forwarded to ports associated with different VLANs, resulting in a breach of VLAN isolation and segmentation boundaries.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11185"
+    },
+    {
+      "type": "WEB",
+      "url": "https://https://www.arista.com/en/support/advisories-notices/security-advisory/21411-security-advisory-0118"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T23:15:20Z"
+  }
+}
@@ -0,0 +1,34 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-2pf3-qwcm-2m4r",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2025-2796"
+  ],
+  "details": "On affected platforms with hardware IPSec support running Arista EOS with IPsec enabled and anti-replay protection configured, EOS may exhibit unexpected behavior in specific cases. Received duplicate encrypted packets, which should be dropped under normal anti-replay protection, will instead be forwarded due to this vulnerability.\n\nNote: this issue does not affect VXLANSec or MACSec encryption functionality.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2796"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21413-security-advisory-0119"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T23:15:21Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-6f46-73v7-w4mr",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2025-2826"
+  ],
+  "details": "n affected platforms running Arista EOS, ACL policies may not be enforced. IPv4 ingress ACL, MAC ingress ACL, or IPv6 standard ingress ACL enabled on one or more ethernet or LAG interfaces may result in ACL policies not being enforced for ingress packets. This can cause incoming packets to incorrectly be allowed or denied. The two symptoms of this issue on the affected release and platform are:\n\n  *  Packets which should be permitted may be dropped and,\n  *  Packets which should be dropped may be permitted.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2826"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/21414-security-advisory-0120"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1284"
+    ],
+    "severity": "LOW",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T23:15:21Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-g36v-w2xm-r289",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2022-21150"
+  ],
+  "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21150"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T23:15:19Z"
+  }
+}
@@ -0,0 +1,36 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-jp64-jgv4-9vfq",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2024-45094"
+  ],
+  "details": "IBM DS8900F and DS8A00 Hardware Management Console (HMC) is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-45094"
+    },
+    {
+      "type": "WEB",
+      "url": "https://www.ibm.com/support/pages/node/7234276"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T23:15:21Z"
+  }
+}
@@ -0,0 +1,39 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-p745-hrr6-rg8c",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2025-40911"
+  ],
+  "details": "Net::CIDR::Set versions 0.10 through 0.13 for Perl does not properly handle leading zero characters in IP CIDR address strings, which could allow attackers to bypass access control that is based on IP addresses.\n\nLeading zeros are used to indicate octal numbers, which can confuse users who are intentionally using octal notation, as well as users who believe they are using decimal notation.\n\nNet::CIDR::Set used code from Net::CIDR::Lite, which had a similar vulnerability CVE-2021-47154.",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-40911"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/robrwo/perl-Net-CIDR-Set/commit/be7d91e8446ad8013b08b4be313d666dab003a8a.patch"
+    },
+    {
+      "type": "WEB",
+      "url": "https://blog.urth.org/2021/03/29/security-issues-in-perl-ip-address-distros"
+    },
+    {
+      "type": "WEB",
+      "url": "https://metacpan.org/release/RRWO/Net-CIDR-Set-0.14/changes"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-1287"
+    ],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T22:15:22Z"
+  }
+}
@@ -0,0 +1,25 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-vrwm-pjh8-xjgm",
+  "modified": "2025-05-28T00:30:35Z",
+  "published": "2025-05-28T00:30:35Z",
+  "aliases": [
+    "CVE-2022-21200"
+  ],
+  "details": "Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused",
+  "severity": [],
+  "affected": [],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21200"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [],
+    "severity": null,
+    "github_reviewed": false,
+    "github_reviewed_at": null,
+    "nvd_published_at": "2025-05-27T23:15:20Z"
+  }
+}