CVE-2023-42419

Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)

Low · published March 5, 2024

CVSS v3.1
3.8
EPSS
0%
Percentile
3.0
In the wild
Unconfirmed
What it is

Maintenance Server, in Cybellum's QCOW air-gapped distribution (China Edition), versions 2.15.5 through 2.27, was compiled with a hard-coded private cryptographic key.

An attacker with administrative privileges & access to the air-gapped server could potentially use this key to run commands on the server.

The issue was resolved in version 2.28.

Earlier versions, including all Cybellum 1.x versions, and distributions for the rest of the world remain unaffected.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00139 · 3.0th percentile
Published
2024-03-05T05:23Z
EPSS history
Timeline
  • 05 MAR 05:23Z
    Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)
    cvelistv5