<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for libslirp</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:1730-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-05-18T14:56:39Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-05-18T14:56:39Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-05-18T14:56:39Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for libslirp</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for libslirp fixes the following issues:

- CVE-2021-3592: Fixed invalid pointer initialization may lead to information disclosure (bootp) (bsc#1187364).
- CVE-2021-3594: Fixed invalid pointer initialization may lead to information disclosure (udp) (bsc#1187367).
- CVE-2021-3595: Fixed invalid pointer initialization may lead to information disclosure (tftp) (bsc#1187366).
- Fix a dhcp regression [bsc#1198773]
  </Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">Container rancher/elemental-teal-iso/5.4:latest-2022-1730,Container rancher/elemental-teal-rt/5.4:latest-2022-1730,Container rancher/elemental-teal/5.4:latest-2022-1730,SUSE-2022-1730,SUSE-SLE-Module-Server-Applications-15-SP3-2022-1730,SUSE-SLE-Module-Server-Applications-15-SP4-2022-1730,SUSE-SUSE-MicroOS-5.1-2022-1730,SUSE-SUSE-MicroOS-5.2-2022-1730,openSUSE-SLE-15.3-2022-1730,openSUSE-SLE-15.4-2022-1730</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221730-1/</URL>
      <Description>Link for SUSE-SU-2022:1730-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-May/011076.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:1730-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1187364</URL>
      <Description>SUSE Bug 1187364</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1187366</URL>
      <Description>SUSE Bug 1187366</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1187367</URL>
      <Description>SUSE Bug 1187367</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1198773</URL>
      <Description>SUSE Bug 1198773</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2021-3592/</URL>
      <Description>SUSE CVE CVE-2021-3592 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2021-3594/</URL>
      <Description>SUSE CVE CVE-2021-3594 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2021-3595/</URL>
      <Description>SUSE CVE CVE-2021-3595 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="Container rancher/elemental-teal-iso/5.4:latest">
      <Branch Type="Product Name" Name="Container rancher/elemental-teal-iso/5.4:latest">
        <FullProductName ProductID="Container rancher/elemental-teal-iso/5.4:latest">Container rancher/elemental-teal-iso/5.4:latest</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Container rancher/elemental-teal-rt/5.4:latest">
      <Branch Type="Product Name" Name="Container rancher/elemental-teal-rt/5.4:latest">
        <FullProductName ProductID="Container rancher/elemental-teal-rt/5.4:latest">Container rancher/elemental-teal-rt/5.4:latest</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="Container rancher/elemental-teal/5.4:latest">
      <Branch Type="Product Name" Name="Container rancher/elemental-teal/5.4:latest">
        <FullProductName ProductID="Container rancher/elemental-teal/5.4:latest">Container rancher/elemental-teal/5.4:latest</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Micro 5.1">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Micro 5.1">
        <FullProductName ProductID="SUSE Linux Enterprise Micro 5.1" CPE="cpe:/o:suse:suse-microos:5.1">SUSE Linux Enterprise Micro 5.1</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Micro 5.2">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Micro 5.2">
        <FullProductName ProductID="SUSE Linux Enterprise Micro 5.2" CPE="cpe:/o:suse:suse-microos:5.2">SUSE Linux Enterprise Micro 5.2</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Server Applications 15 SP3">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Server Applications 15 SP3">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15 SP3" CPE="cpe:/o:suse:sle-module-server-applications:15:sp3">SUSE Linux Enterprise Module for Server Applications 15 SP3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Server Applications 15 SP4">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Server Applications 15 SP4">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15 SP4" CPE="cpe:/o:suse:sle-module-server-applications:15:sp4">SUSE Linux Enterprise Module for Server Applications 15 SP4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.3">
      <Branch Type="Product Name" Name="openSUSE Leap 15.3">
        <FullProductName ProductID="openSUSE Leap 15.3" CPE="cpe:/o:opensuse:leap:15.3">openSUSE Leap 15.3</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Family" Name="openSUSE Leap 15.4">
      <Branch Type="Product Name" Name="openSUSE Leap 15.4">
        <FullProductName ProductID="openSUSE Leap 15.4" CPE="cpe:/o:opensuse:leap:15.4">openSUSE Leap 15.4</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libslirp0-4.3.1-150300.6.2">
      <FullProductName ProductID="libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="libslirp-devel-4.3.1-150300.6.2">
      <FullProductName ProductID="libslirp-devel-4.3.1-150300.6.2">libslirp-devel-4.3.1-150300.6.2</FullProductName>
    </Branch>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="Container rancher/elemental-teal-iso/5.4:latest">
      <FullProductName ProductID="Container rancher/elemental-teal-iso/5.4:latest:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of Container rancher/elemental-teal-iso/5.4:latest</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="Container rancher/elemental-teal-rt/5.4:latest">
      <FullProductName ProductID="Container rancher/elemental-teal-rt/5.4:latest:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of Container rancher/elemental-teal-rt/5.4:latest</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="Container rancher/elemental-teal/5.4:latest">
      <FullProductName ProductID="Container rancher/elemental-teal/5.4:latest:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of Container rancher/elemental-teal/5.4:latest</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Micro 5.1">
      <FullProductName ProductID="SUSE Linux Enterprise Micro 5.1:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of SUSE Linux Enterprise Micro 5.1</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Micro 5.2">
      <FullProductName ProductID="SUSE Linux Enterprise Micro 5.2:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of SUSE Linux Enterprise Micro 5.2</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp-devel-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp-devel-4.3.1-150300.6.2">libslirp-devel-4.3.1-150300.6.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15 SP3">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp-devel-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp-devel-4.3.1-150300.6.2">libslirp-devel-4.3.1-150300.6.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Server Applications 15 SP4">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp-devel-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libslirp-devel-4.3.1-150300.6.2">libslirp-devel-4.3.1-150300.6.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.3">
      <FullProductName ProductID="openSUSE Leap 15.3:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of openSUSE Leap 15.3</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp-devel-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:libslirp-devel-4.3.1-150300.6.2">libslirp-devel-4.3.1-150300.6.2 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
    <Relationship ProductReference="libslirp0-4.3.1-150300.6.2" RelationType="Default Component Of" RelatesToProductReference="openSUSE Leap 15.4">
      <FullProductName ProductID="openSUSE Leap 15.4:libslirp0-4.3.1-150300.6.2">libslirp0-4.3.1-150300.6.2 as a component of openSUSE Leap 15.4</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the bootp_input() function and could occur while processing a udp packet that is smaller than the size of the 'bootp_t' structure. A malicious guest could use this flaw to leak 10 bytes of uninitialized heap memory from the host. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.</Note>
    </Notes>
    <CVE>CVE-2021-3592</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container rancher/elemental-teal-iso/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>Container rancher/elemental-teal-rt/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>Container rancher/elemental-teal/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Micro 5.1:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Micro 5.2:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.4:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.4:libslirp0-4.3.1-150300.6.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221730-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2021-3592.html</URL>
        <Description>CVE-2021-3592</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1187364</URL>
        <Description>SUSE Bug 1187364</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1187369</URL>
        <Description>SUSE Bug 1187369</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the udp_input() function and could occur while processing a udp packet that is smaller than the size of the 'udphdr' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.</Note>
    </Notes>
    <CVE>CVE-2021-3594</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container rancher/elemental-teal-iso/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>Container rancher/elemental-teal-rt/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>Container rancher/elemental-teal/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Micro 5.1:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Micro 5.2:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.4:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.4:libslirp0-4.3.1-150300.6.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221730-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2021-3594.html</URL>
        <Description>CVE-2021-3594</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1187367</URL>
        <Description>SUSE Bug 1187367</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in the tftp_input() function and could occur while processing a udp packet that is smaller than the size of the 'tftp_t' structure. This issue may lead to out-of-bounds read access or indirect host memory disclosure to the guest. The highest threat from this vulnerability is to data confidentiality. This flaw affects libslirp versions prior to 4.6.0.</Note>
    </Notes>
    <CVE>CVE-2021-3595</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>Container rancher/elemental-teal-iso/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>Container rancher/elemental-teal-rt/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>Container rancher/elemental-teal/5.4:latest:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Micro 5.1:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Micro 5.2:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP3:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Server Applications 15 SP4:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.3:libslirp0-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.4:libslirp-devel-4.3.1-150300.6.2</ProductID>
        <ProductID>openSUSE Leap 15.4:libslirp0-4.3.1-150300.6.2</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>low</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>2.1</BaseScoreV2>
        <VectorV2>AV:L/AC:L/Au:N/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>3.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221730-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2021-3595.html</URL>
        <Description>CVE-2021-3595</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1187366</URL>
        <Description>SUSE Bug 1187366</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1187376</URL>
        <Description>SUSE Bug 1187376</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
