PatchTheCVEeve vulnerabilities and fixes
Recent CVEs affecting eve, with upgrade or downgrade steps. 4 tracked.
eve has 4 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 4. Most recent: 2023-09-21. Highest priority: CVE-2018-8097 (score 63/100).
- CVE-2023-43637 HIGH 7.8 UPGRADE Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key would always ha
- CVE-2023-43634 HIGH 8.8 UPGRADE When sealing/unsealing the “vault” key, a list of PCRs is used, which defines which PCRs are used. In a prev
- CVE-2023-43633 HIGH 8.8 UPGRADE On boot, the Pillar eve container checks for the existence and content of “/config/GlobalConfig/global.json”.
- CVE-2018-8097 CRITICAL 9.8 UPGRADE io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code
FAQ
How do I fix eve vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is eve being exploited right now?
None of the tracked eve CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which eve CVE should I patch first?
CVE-2018-8097 currently ranks highest (63/100): io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code .