Security vulnerabilities in 3rd party packages shipped with VDDK Linux 7.0.3.2

andre_o — Wed, 15 Mar 2023 04:53:24 GMT

VDDK version 7.0.3.2 includes few third party packages which have known security vulnerabilities:

zlib-1.2.12 (https://nvd.nist.gov/vuln/detail/CVE-2022-37434)
OpenSSL-1.0.2ze (https://nvd.nist.gov/vuln/detail/CVE-2022-2068)
curl-7.76.1 (https://nvd.nist.gov/vuln/detail/CVE-2021-22901,
https://nvd.nist.gov/vuln/detail/CVE-2021-22898, https://nvd.nist.gov/vuln/detail/CVE-2021-22897)

Could someone please share some details on whether the above-states vulnerabilities are affecting (and/or can be exploited via) the VDDK? If so, we would kindly request a 7.0.3.X VDDK update with those third party packages upgraded to patched version.

If VDDK is not affected, it would be great to have some details why/how

Thanks a lot!

andre_o Tracker

Security vulnerabilities in 3rd party packages shipped with VDDK Linux 7.0.3.2