{
  "version": "1",
  "package": [
    {
      "name": "kexec-tools",
      "layer": "meta",
      "version": "2.0.28",
      "products": [
        {
          "product": "kexec-tools",
          "cvesInRecord": "Yes"
        }
      ],
      "issue": [
        {
          "id": "CVE-2011-3588",
          "summary": "The SSH configuration in the Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, disables the StrictHostKeyChecking option, which allows man-in-the-middle attackers to spoof kdump servers, and obtain sensitive core information, by using an arbitrary SSH key.",
          "scorev2": "5.7",
          "scorev3": "0.0",
          "scorev4": "0.0",
          "vector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:M/Au:N/C:C/I:N/A:N",
          "status": "Patched",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-3588"
        },
        {
          "id": "CVE-2011-3589",
          "summary": "The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, uses world-readable permissions for vmcore files, which allows local users to obtain sensitive information by inspecting the file content, as demonstrated by a search for a root SSH key.",
          "scorev2": "5.7",
          "scorev3": "0.0",
          "scorev4": "0.0",
          "vector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:M/Au:N/C:C/I:N/A:N",
          "status": "Patched",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-3589"
        },
        {
          "id": "CVE-2011-3590",
          "summary": "The Red Hat mkdumprd script for kexec-tools, as distributed in the kexec-tools 1.x before 1.102pre-154 and 2.x before 2.0.0-209 packages in Red Hat Enterprise Linux, includes all of root's SSH private keys within a vmcore file, which allows context-dependent attackers to obtain sensitive information by inspecting the file content.",
          "scorev2": "5.7",
          "scorev3": "0.0",
          "scorev4": "0.0",
          "vector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:M/Au:N/C:C/I:N/A:N",
          "status": "Patched",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2011-3590"
        },
        {
          "id": "CVE-2015-0267",
          "summary": "The Red Hat module-setup.sh script for kexec-tools, as distributed in the kexec-tools before 2.0.7-19 packages in Red Hat Enterprise Linux, allows local users to write to arbitrary files via a symlink attack on a temporary file.",
          "scorev2": "3.6",
          "scorev3": "0.0",
          "scorev4": "0.0",
          "vector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:P",
          "status": "Patched",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2015-0267"
        },
        {
          "id": "CVE-2021-20269",
          "summary": "A flaw was found in the permissions of a log file created by kexec-tools. This flaw allows a local unprivileged user to read this file and leak kernel internal information from a previous panic. The highest threat from this vulnerability is to confidentiality. This flaw affects kexec-tools shipped by Fedora versions prior to 2.0.21-8 and RHEL versions prior to 2.0.20-47.",
          "scorev2": "2.1",
          "scorev3": "5.5",
          "scorev4": "0.0",
          "vector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
          "status": "Patched",
          "link": "https://nvd.nist.gov/vuln/detail/CVE-2021-20269"
        }
      ]
    }
  ]
}