Array index error in the scanstring function in the _json module in Python 2.7 through 3.5 and simplejson before 2.6.1 allows context-dependent attackers to read arbitrary process memory via a negative index value in the idx argument to the raw_decode function.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:1064 advisory.

    Python is an interpreted, interactive, object-oriented programming language     that supports modules, classes, exceptions, high-level dynamic data types,     and dynamic typing. The python27 collection provide a stable release of     Python 2.7 with a number of additional utilities and database connectors     for MySQL and PostgreSQL.

    The python27-python packages have been upgraded to upstream version 2.7.8,     which provides numerous bug fixes over the previous version. (BZ#1167912)

    The following security issues were fixed in the python27-python component:

    It was discovered that the socket.recvfrom_into() function failed to check     the size of the supplied buffer. This could lead to a buffer overflow when     the function was called with an insufficiently sized buffer.
    (CVE-2014-1912)

    It was discovered that the Python xmlrpclib module did not restrict the     size of gzip-compressed HTTP responses. A malicious XMLRPC server could     cause an XMLRPC client using xmlrpclib to consume an excessive amount of     memory. (CVE-2013-1753)

    It was discovered that multiple Python standard library modules     implementing network protocols (such as httplib or smtplib) failed to     restrict the sizes of server responses. A malicious server could cause a     client using one of the affected modules to consume an excessive amount of     memory. (CVE-2013-1752)

    It was discovered that the CGIHTTPServer module incorrectly handled URL     encoded paths. A remote attacker could use this flaw to execute scripts     outside of the cgi-bin directory, or disclose the source code of the     scripts in the cgi-bin directory. (CVE-2014-4650)

    An integer overflow flaw was found in the way the buffer() function handled     its offset and size arguments. An attacker able to control these arguments     could use this flaw to disclose portions of the application memory or cause     it to crash. (CVE-2014-7185)

    The following security issue was fixed in the python27-python and     python27-python-simplejson components:

    A flaw was found in the way the json module handled negative index     arguments passed to certain functions (such as raw_decode()). An attacker     able to control the index value passed to one of the affected functions     could possibly use this flaw to disclose portions of the application     memory. (CVE-2014-4616)

    In addition, this update adds the following enhancement:

    * The python27 Software Collection now includes the python-wheel and     python-pip modules. (BZ#994189, BZ#1167902)

    All python27 users are advised to upgrade to these updated packages, which     correct these issues and add these enhancements. All running python27     instances must be restarted for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python: missing boundary check in JSON module (CVE-2014-4616)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 5 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python: missing boundary check in JSON module (CVE-2014-4616)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-1064 advisory.

    - Add httplib fix for CVE-2013-1752     Resolves: rhbz#1187779
    - Fixed CVE-2013-1752, CVE-2013-1753     Resolves: rhbz#1187779

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the python packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - It was found that Python's smtplib library did not     return an exception when StartTLS failed to be     established in the SMTP.starttls() function. A man in     the middle attacker could strip out the STARTTLS     command without generating an exception on the Python     SMTP client application, preventing the establishment     of the TLS layer.(CVE-2016-0772)

  - A vulnerability was discovered in Python, in the     built-in zipimporter. A specially crafted zip file     placed in a module path such that it would be loaded by     a later 'import' statement could cause a heap overflow,     leading to arbitrary code execution.(CVE-2016-5636)

  - A flaw was found in the way the DES/3DES cipher was     used as part of the TLS/SSL protocol. A     man-in-the-middle attacker could use this flaw to     recover some plaintext data by capturing large amounts     of encrypted traffic between TLS/SSL server and client     if the communication used a DES/3DES based     ciphersuite.(CVE-2016-2183)

  - The Python standard library HTTP client modules (such     as httplib or urllib) did not perform verification of     TLS/SSL certificates when connecting to HTTPS servers.
    A man-in-the-middle attacker could use this flaw to     hijack connections and eavesdrop or modify transferred     data.(CVE-2014-9365)

  - An integer overflow flaw was found in the way the     buffer() function handled its offset and size     arguments. An attacker able to control those arguments     could use this flaw to disclose portions of the     application memory or cause it to crash.(CVE-2014-7185)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's pop3lib's apop() method. An     attacker could use this flaw to cause denial of     service.(CVE-2018-1060)

  - The ssl.match_hostname function in the SSL module in     Python 2.6 through 3.4 does not properly handle a '\\0'     character in a domain name in the Subject Alternative     Name field of an X.509 certificate, which allows     man-in-the-middle attackers to spoof arbitrary SSL     servers via a crafted certificate issued by a     legitimate Certification Authority, a related issue to     CVE-2009-2408.(CVE-2013-4238)

  - It was found that the Python's httplib library (used by     urllib, urllib2 and others) did not properly check     HTTPConnection.putheader() function arguments. An     attacker could use this flaw to inject additional     headers in a Python application that allowed user     provided header names or values.(CVE-2016-5699)

  - CPython (aka Python) up to 2.7.13 is vulnerable to an     integer overflow in the PyString_DecodeEscape function     in stringobject.c, resulting in heap-based buffer     overflow (and possible arbitrary code     execution)(CVE-2017-1000158)

  - A flaw was found in the way catastrophic backtracking     was implemented in python's difflib.IS_LINE_JUNK     method. An attacker could use this flaw to cause denial     of service.(CVE-2018-1061)

  - It was discovered that multiple Python standard library     modules implementing network protocols (such as httplib     or smtplib) failed to restrict sizes of server     responses. A malicious server could cause a client     using one of the affected modules to consume an     excessive amount of memory.(CVE-2013-1752)

  - A flaw was found in the way the json module handled     negative index argument passed to certain functions     (such as raw_decode()). An attacker able to control     index value passed to one of the affected functions     could possibly use this flaw to disclose portions of     the application memory.(CVE-2014-4616)

  - urllib in Python 2.x through 2.7.16 supports the     local_file: scheme, which makes it easier for remote     attackers to bypass protection mechanisms that     blacklist file: URIs, as demonstrated by triggering a     urllib.urlopen('local_file:///etc/passwd')     call.(CVE-2019-9948)

  - Python's elementtree C accelerator failed to initialise     Expat's hash salt during initialization. This could     make it easy to conduct denial of service attacks     against Expat by contructing an XML document that would     cause pathological hash collisions in Expat's internal     data structures, consuming large amounts CPU and     RAM.(CVE-2018-14647)

  - A null pointer dereference vulnerability was found in     the certificate parsing code in Python. This causes a     denial of service to applications when parsing     specially crafted certificates. This vulnerability is     unlikely to be triggered if application enables SSL/TLS     certificate validation and accepts certificates only     from trusted root certificate     authorities.(CVE-2019-5010)

  - Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is     affected by: Improper Handling of Unicode Encoding     (with an incorrect netloc) during NFKC normalization.
    The impact is: Information disclosure (credentials,     cookies, etc. that are cached against a given     hostname). The components are: urllib.parse.urlsplit,     urllib.parse.urlparse. The attack vector is: A     specially crafted URL could be incorrectly parsed to     locate cookies or authentication data and send that     information to a different host than when parsed     correctly.(CVE-2019-9636)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

This update also fixes the following bugs :

  - Subprocesses used with the Eventlet library or regular     threads previously tried to close epoll file descriptors     twice, which led to an 'Invalid argument' error.
    Subprocesses have been fixed to close the file     descriptors only once.

  - When importing the readline module from a Python script,     Python no longer produces erroneous random characters on     stdout.

  - The cProfile utility has been fixed to print all values     that the '-s' option supports when this option is used     without a correct value.

  - The load_cert_chain() function now accepts 'None' as a     keyfile argument.

In addition, this update adds the following enhancements :

  - Security enhancements as described in PEP 466 have been     backported to the Python standard library, for example,     new features of the ssl module: Server Name Indication     (SNI) support, support for new TLSv1.x protocols, new     hash algorithms in the hashlib module, and many more.

  - Support for the ssl.PROTOCOL_TLSv1_2 protocol has been     added to the ssl library.

  - The ssl.SSLSocket.version() method is now available to     access information about the version of the SSL protocol     used in a connection.

Updated python packages that fix multiple security issues, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

Python is an interpreted, interactive, object-oriented programming language often compared to Tcl, Perl, Scheme, or Java. Python includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems (X11, Motif, Tk, Mac and MFC).

It was discovered that the Python xmlrpclib module did not restrict the size of gzip-compressed HTTP responses. A malicious XMLRPC server could cause an XMLRPC client using xmlrpclib to consume an excessive amount of memory. (CVE-2013-1753)

It was discovered that multiple Python standard library modules implementing network protocols (such as httplib or smtplib) failed to restrict the sizes of server responses. A malicious server could cause a client using one of the affected modules to consume an excessive amount of memory. (CVE-2013-1752)

It was discovered that the CGIHTTPServer module incorrectly handled URL encoded paths. A remote attacker could use this flaw to execute scripts outside of the cgi-bin directory, or disclose the source code of the scripts in the cgi-bin directory. (CVE-2014-4650)

An integer overflow flaw was found in the way the buffer() function handled its offset and size arguments. An attacker able to control these arguments could use this flaw to disclose portions of the application memory or cause it to crash. (CVE-2014-7185)

A flaw was found in the way the json module handled negative index arguments passed to certain functions (such as raw_decode()). An attacker able to control the index value passed to one of the affected functions could possibly use this flaw to disclose portions of the application memory. (CVE-2014-4616)

The Python standard library HTTP client modules (such as httplib or urllib) did not perform verification of TLS/SSL certificates when connecting to HTTPS servers. A man-in-the-middle attacker could use this flaw to hijack connections and eavesdrop or modify transferred data. (CVE-2014-9365)

Note: The Python standard library was updated to make it possible to enable certificate verification by default. However, for backwards compatibility, verification remains disabled by default. Future updates may change this default. Refer to the Knowledgebase article 2039753 linked to in the References section for further details about this change. (BZ#1219108)

This update also fixes the following bugs :

* Subprocesses used with the Eventlet library or regular threads previously tried to close epoll file descriptors twice, which led to an 'Invalid argument' error. Subprocesses have been fixed to close the file descriptors only once. (BZ#1103452)

* When importing the readline module from a Python script, Python no longer produces erroneous random characters on stdout. (BZ#1189301)

* The cProfile utility has been fixed to print all values that the '-s' option supports when this option is used without a correct value.
(BZ#1237107)

* The load_cert_chain() function now accepts 'None' as a keyfile argument. (BZ#1250611)

In addition, this update adds the following enhancements :

* Security enhancements as described in PEP 466 have been backported to the Python standard library, for example, new features of the ssl module: Server Name Indication (SNI) support, support for new TLSv1.x protocols, new hash algorithms in the hashlib module, and many more.
(BZ#1111461)

* Support for the ssl.PROTOCOL_TLSv1_2 protocol has been added to the ssl library. (BZ#1192015)

* The ssl.SSLSocket.version() method is now available to access information about the version of the SSL protocol used in a connection. (BZ#1259421)

All python users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements.

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2015-2101 advisory.

    - Fixed CVE-2013-1753, CVE-2013-1752, CVE-2014-4616, CVE-2014-4650, CVE-2014-7185     Resolves: rhbz#1206574

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2101 advisory.

  - python: multiple unbound readline() DoS flaws in python stdlib (CVE-2013-1752)

  - python: XMLRPC library unrestricted decompression of HTTP responses using gzip enconding (CVE-2013-1753)

  - python: missing boundary check in JSON module (CVE-2014-4616)

  - python: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs (CVE-2014-4650)

  - python: buffer() integer overflow leading to out of bounds read (CVE-2014-7185)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2653-1 advisory.

    It was discovered that multiple Python protocol libraries incorrectly limited certain data when connecting     to servers. A malicious ftp, http, imap, nntp, pop or smtp server could use this issue to cause a denial     of service. (CVE-2013-1752)

    It was discovered that the Python xmlrpc library did not limit unpacking gzip-compressed HTTP bodies. A     malicious server could use this issue to cause a denial of service. (CVE-2013-1753)

    It was discovered that the Python json module incorrectly handled a certain argument. An attacker could     possibly use this issue to read arbitrary memory and expose sensitive information. This issue only     affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-4616)

    It was discovered that the Python CGIHTTPServer incorrectly handled URL-encoded path separators in URLs. A     remote attacker could use this issue to expose sensitive information, or possibly execute arbitrary code.
    This issue only affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-4650)

    It was discovered that Python incorrectly handled sizes and offsets in buffer functions. An attacker could     possibly use this issue to read arbitrary memory and obtain sensitive information. This issue only     affected Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-7185)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated python3 packages fix security vulnerabilities :

ZipExtFile.read goes into 100% CPU infinite loop on maliciously binary edited zips (CVE-2013-7338).

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code (CVE-2014-1912).

It was reported that a patch added to Python 3.2 caused a race condition where a file created could be created with world read/write permissions instead of the permissions dictated by the original umask of the process. This could allow a local attacker that could win the race to view and edit files created by a program using this call. Note that prior versions of Python, including 2.x, do not include the vulnerable _get_masked_mode() function that is used by os.makedirs() when exist_ok is set to True (CVE-2014-2667).

Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).

Updated python packages fix security vulnerabilities :

A vulnerability was reported in Python's socket module, due to a boundary error within the sock_recvfrom_into() function, which could be exploited to cause a buffer overflow. This could be used to crash a Python application that uses the socket.recvfrom_info() function or, possibly, execute arbitrary code with the permissions of the user running vulnerable Python code (CVE-2014-1912).

This updates the python package to version 2.7.6, which fixes several other bugs, including denial of service flaws due to unbound readline() calls in the ftplib and nntplib modules (CVE-2013-1752).

Denial of service flaws due to unbound readline() calls in the imaplib, poplib, and smtplib modules (CVE-2013-1752).

A gzip bomb and unbound read denial of service flaw in python XMLRPC library (CVE-2013-1753).

Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

The CGIHTTPServer Python module does not properly handle URL-encoded path separators in URLs. This may enable attackers to disclose a CGI script's source code or execute arbitrary scripts in the server's document root (CVE-2014-4650).

Python before 2.7.8 is vulnerable to an integer overflow in the buffer type (CVE-2014-7185).

When Python's standard library HTTP clients (httplib, urllib, urllib2, xmlrpclib) are used to access resources with HTTPS, by default the certificate is not checked against any trust store, nor is the hostname in the certificate checked against the requested host. It was possible to configure a trust root to be checked against, however there were no faculties for hostname checking (CVE-2014-9365).

The python-pip and tix packages was added due to missing build dependencies.

The remote host is affected by the vulnerability described in GLSA-201503-10 (Python: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Python. Please review       the CVE identifiers referenced below for details.
  Impact :

    A context-dependent attacker may be able to execute arbitrary code or       cause a Denial of Service condition.
  Workaround :

    There is no known workaround at this time.

Fix for CVE-2014-4650: CGIHTTPServer module does not properly handle URL-encoded path separators in URLs. Fix for CVE-2014-4650

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was reported that Python built-in _json module have a flaw (insufficient bounds checking), which allows a local user to read current process' arbitrary memory.

Quoting the upstream bug report :

'The sole prerequisites of this attack are that the attacker is able to control or influence the two parameters of the default scanstring function: the string to be decoded and the index.

The bug is caused by allowing the user to supply a negative index value. The index value is then used directly as an index to an array in the C code; internally the address of the array and its index are added to each other in order to yield the address of the value that is desired. However, by supplying a negative index value and adding this to the address of the array, the processor's register value wraps around and the calculated value will point to a position in memory which isn't within the bounds of the supplied string, causing the function to access other parts of the process memory.'

Fix for CVE-2014-4616

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

python and python3 were updated to fix one security issue.

This security issue was fixed :

  - Missing boundary check in JSON module (CVE-2014-4616)

Updated python and python-simplejson package fixes security vulnerability

Python are susceptible to arbitrary process memory reading by a user or adversary due to a bug in the _json module caused by insufficient bounds checking. The bug is caused by allowing the user to supply a negative value that is used an an array index, causing the scanstring function to access process memory outside of the string it is intended to access (CVE-2014-4616).

This issue also affected the python-simplejson package, which has been patched to fix the bug.

ID	Name	Product	Family	Severity
210167	RHEL 6 / 7 : python27 (RHSA-2015:1064)	Nessus	Red Hat Local Security Checks	critical
199106	RHEL 6 : python33-python (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
199094	RHEL 5 : python33-python (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
181042	Oracle Linux 6 / 7 : python27 (ELSA-2015-1064)	Nessus	Oracle Linux Local Security Checks	critical
124937	EulerOS Virtualization 3.0.1.0 : python (EulerOS-SA-2019-1434)	Nessus	Huawei Local Security Checks	critical
87570	Scientific Linux Security Update : python on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	critical
87129	CentOS 7 : python (CESA-2015:2101)	Nessus	CentOS Local Security Checks	critical
87020	Oracle Linux 7 : python (ELSA-2015-2101)	Nessus	Oracle Linux Local Security Checks	critical
86968	RHEL 7 : python (RHSA-2015:2101)	Nessus	Red Hat Local Security Checks	critical
84428	Ubuntu 14.04 LTS : Python vulnerabilities (USN-2653-1)	Nessus	Ubuntu Local Security Checks	critical
82329	Mandriva Linux Security Advisory : python3 (MDVSA-2015:076)	Nessus	Mandriva Local Security Checks	high
82328	Mandriva Linux Security Advisory : python (MDVSA-2015:075)	Nessus	Mandriva Local Security Checks	high
82009	GLSA-201503-10 : Python: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
79238	Fedora 19 : python3-3.3.2-10.fc19 (2014-14257)	Nessus	Fedora Local Security Checks	medium
79095	Fedora 21 : python3-3.4.1-16.fc21 (2014-14208)	Nessus	Fedora Local Security Checks	medium
79076	Fedora 20 : python3-3.3.2-18.fc20 (2014-14245)	Nessus	Fedora Local Security Checks	medium
78323	Amazon Linux AMI : python27 (ALAS-2014-380)	Nessus	Amazon Linux Local Security Checks	medium
78317	Amazon Linux AMI : python-simplejson (ALAS-2014-374)	Nessus	Amazon Linux Local Security Checks	medium
76540	Fedora 19 : python3-3.3.2-9.fc19 (2014-8035)	Nessus	Fedora Local Security Checks	medium
76539	Fedora 19 : python-2.7.5-13.fc19 (2014-7772)	Nessus	Fedora Local Security Checks	medium
76488	openSUSE Security Update : python / python3 (openSUSE-SU-2014:0890-1)	Nessus	SuSE Local Security Checks	medium
76471	Mandriva Linux Security Advisory : python (MDVSA-2014:135)	Nessus	Mandriva Local Security Checks	low
76328	Fedora 20 : python-2.7.5-13.fc20 (2014-7800)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2014-4616

medium

Tenable Plugins

critical

medium

medium

critical

critical

critical

critical

critical

critical

critical

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

low

medium