Brocade SANnav Vulnerability Disclosures
Brocade Security Advisories posted on July 28, 2026
CVEs addressed in SANnav 3.0.1 and 3.0.0a
CVE-2026-5047
base64 encoded password is seen in fe-consolidated logs
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37933
CVE-2026-5049
Path traversal via unsanitized multipart filename in Zone Alias Import
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37931
CVE-2026-5048
SQL injection vulnerability on multiple external APIs
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37932
CVE-2025-15467
Stack buffer overflow in CMS AuthEnvelopedData parsing in DR
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37940
CVE-2025-68428, CVE-2026-24040, CVE-2026-24043, CVE-2026-24133, CVE-2026-24737, CVE-2026-25535, CVE-2026-25755, CVE-2026-25940
Multiples vulnerabilities in jsPDF
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37941
CVE-2026-25639
Axios affected by Denial of Service via __proto__ Key in mergeConfig
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37942
CVE-2026-2006, CVE-2026-2005, CVE-2026-2004, CVE-2026-2003, CVE-2025-55754
Postgres Vulnerabilities in Brocade SANanv before 3.0.1
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37944
CVE-2025-13465
Lodash version 4.17.21 is affected by Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37945
CVE-2025-13034, CVE-2025-15079, CVE-2025-15224, CVE-2025-14524, CVE-2025-14819, CVE-2025-14017, CVE-2025-10148
Multiple cURL vulnerabilities identified in Brocade SANnav
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37947
CVE-2025-55131, CVE-2025-55132, CVE-2025-59464, CVE-2025-59465, CVE-2025-59466, CVE-2026-21636, CVE-2026-21637, CVE-2025-55130
Multiple Node.js vulnerabilities identified in Brocade SANnav
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37948
CVE-2025-9086, CVE-2023-53034, CVE-2025-40064, CVE-2025-40304, CVE-2025-40322, CVE-2025-68349, CVE-2025-68811, CVE-2026-22998, CVE-2026-0861, CVE-2026-0915, CVE-2025-15281
RockyLinux security update for glibc (RLSA-2026:2786) and kernel (RLSA-2026:2722), curl (RLSA-2026:1350)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37951
CVE-2025-9231,CVE-2025-9232,CVE-2025-9230
OpenSSL 3.5.0 < 3.5.4 Multiple Vulnerabilities in SANnav images
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37935
CVE-2026-22796, CVE-2025-11187, CVE-2025-15467, CVE-2025-15468, CVE-2025-15469, CVE-2025-66199, CVE-2025-68160, CVE-2025-69418, CVE-2025-69419, CVE-2025-69420, CVE-2025-69421, CVE-2026-22795
OpenSSL 3.5.0 < 3.5.5 Multiple Vulnerabilities in SANnav images
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37936
CVE-2025-9230, CVE-2025-9232
OpenSSL 3.0.0 < 3.0.18 Multiple Vulnerabilities detected in Nginx
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37937
CVE-2025-53057 , CVE-2025-53066 , CVE-2025-31257
Azul Zulu Java Multiple Vulnerabilities (Oct 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37938
CVE-2026-21945, CVE-2026-21932, CVE-2026-21933, CVE-2026-21925, CVE-2026-21945, CVE-2025-6021, CVE-2025-6052, CVE-2025-7425, CVE-2026-21947, CVE-2025-43368, CVE-2025-4721CVE-2025-53057, CVE-2025-53066 , CVE-2025-31257
Oracle Critical Patch Update Advisory for CP - January 2026
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37939
CVE-2025-55754
Apache Tomcat: console manipulation via escape sequences in log messages
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37943
CVE-2025-41254
Spring Framework STOMP CSRF Vulnerability
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37946
CVEs addressed in SANnav 3.0.1
8.x OS OVA update patch provides matching security updates for SANnav 2.4.0b OVA deployments
9.x OS OVA update patch provides matching security updates for SANnav 3.0.0a OVA deployments
CVE-2026-5769
Switch discovery credentials can be seen in plain text inside sannavswapfie
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37934
CVE-2025-37789, CVE-2025-37819, CVE-2025-38022, CVE-2025-38024, CVE-2025-38403, CVE-2025-38415, CVE-2025-38459, CVE-2025-38730, CVE-2025-39760, CVE-2025-40135, CVE-2025-40141, CVE-2025-40158, CVE-2025-40170, CVE-2025-40269, CVE-2025-40271, CVE-2025-40318, CVE-2025-38141, CVE-2025-38349, CVE-2025-38731, CVE-2025-40248, CVE-2025-40258, CVE-2025-40294, CVE-2025-68301, CVE-2025-68305, CVE-2025-38568, CVE-2025-40154, CVE-2025-40251
Security update provided to RockyLinux 9 kernel (RLSA-2026:2212, RLSA-2026:1143, RLSA-2026:1617)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37949
CVE-2025-12084, CVE-2025-64720, CVE-2025-65018, CVE-2025-66293
Security update provided to RLSA-2026:1478 and Rocky Linux Security Update for libpng (RLSA-2026:0238)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37950
CVE-2025-39925, CVE-2025-39979, CVE-2025-38499, CVE-2025-39966, CVE-2025-40176, CVE-2025-5987, CVE-2024-5642, CVE-2025-6069, CVE-2025-8291, CVE-2025-6075, CVE-2025-58183, CVE-2025-45582, CVE-2025-39806, CVE-2025-39840, CVE-2025-39883, CVE-2025-40240, CVE-2025-68973
Rocky Linux Security Update for kernel, libssg, gnupg2, python3.9 & tar
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37952
CVE-2026-0915 CVE-2026-0861 CVE-2025-15281, CVE-2025-68349, CVE-2025-68811 CVE-2025-40304 CVE-2026-22998 CVE-2025-40322 CVE-2025-40064 CVE-2023-53034
Rocky Linux Security Update for glibc (RLSA-2026:2786) and kernel (RLSA-2026:2722)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37953
CVE-2025-59375
LibExpat Vulnerable to Denial-of-Service (DoS) via Uncontrolled Resource Consumption in 'xmlparse.c' File
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37954
CVE-2025-31133, CVE-2025-52565, CVE-2025-52881
security update for multiple “runc” vulnerabilities in Brocade SANnav
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37955
CVE-2024-37891
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37956
CVEs addressed in SANnav 3.0.0a
8.x OS OVA update patch provides matching security updates for SANnav 2.4.0b OVA deployments
9.x OS OVA update patch provides matching security updates for SANnav 3.0.1 OVA deployments
CVE-2026-31431
algif_aead - Revert to operating out-of-place
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37827
CVE-2026-43284
xfrm: esp: avoid in-place decrypt on shared skb frags
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37828
CVE-2026-46300
A flaw was found in the Linux kernel's XFRM ESP-in-TCP subsystem
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37978
CVE-2026-3805. CVE-2026-1965, CVE-2026-3783, CVE-2026-7168, CVE-2026-6429, CVE-2026-6276, CVE-2026-5773, CVE-2026-5545, CVE-2026-6253
Multiples vulnerabilities in Curl
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37980
CVE-2026-22016, CVE-2026-34282, CVE-2026-22021, CVE-2026-22013, CVE-2026-23865, CVE-2026-22018, CVE-2026-22007, CVE-2026-34268
Oracle Java Critical Patch Update Advisory April 2026
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37981
=======================================
Brocade Security Advisories posted on March 3, 2026
CVEs addressed in SANnav 3.0.0
CVE-2025-53905, CVE-2025-53906
Path traversal issues in Vims tar.vim and zip.vim plugins
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37152
CVE-2025-26465
OpenSSH security update for CVE-2025-26465
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37134
CVEs addressed in SANnav 2.4.0b and 3.0.0
CVE-2025-47081
Requests Vulnerable to Information Disclosure via '.netrc' Credentials Leak in 'get_netrc_auth()' Function
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37150
CVE-2025-5914
libarchive Vulnerable to Memory Corruption via Integer Overflow in 'archive_read_format_rar_seek_data()' Function
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37143
CVE-2025-32990, CVE-2025-6395
LibExpat Vulnerable to Denial-of-Service (DoS) via Uncontrolled Resource Consumption in 'xmlparse.c' File
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37140
CVE-2025-40778
Cache poisoning attacks with unsolicited RRs
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37136
CVEs addressed in SANnav 2.4.0b and OVA_9x_os_02_2026 patch for SANnav 3.0.0
CVE-2025-11561
sssd default kerberos configuration allows privilege escalation on ad-joined linux systems
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37146
CVEs addressed in SANnav 2.4.0a and 3.0.0
CVE-2025-0624
GRUB2 Vulnerable to Out-of-Bounds Write via Network Boot Process in 'grub_strcpy()' Function
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37142
CVEs addressed in SANnav 2.4.0
CVE-2025-4945, CVE-2025-11021
Libsoup Vulnerable to Integer Overflow via Cookie Expiration Date Handling in Cookie Parsing Logic and Vulnerable to Information Exposure via Out-of-Bounds Read in HTTP Library Component
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/37144
=======================================
Brocade Security Advisories posted on February 19, 2026
CVEs addressed in SANnav 9.x OS OVA patch
CVE-2025-15467
OpenSSL Stack buffer overflow in CMS AuthEnvelopedData parsing
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36980
CVE-2025-61985
OpenSSH security update (CVE-2025-61985)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36979
=======================================
Brocade Security Advisories posted on January 27, 2026
CVEs addressed in SANnav v3.0.0 and v2.4.0b
CVE-2025-12680
SANnav DataBase password in plain text is logged in failover logs
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36844
CVE-2025-12679
Plain text pbe key visible in audit log during migration from 2.4.0a to 3.0.0
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36845
CVE-2025-12772
Plaintext Switch admin login password is seen in Brocade SANnav support save 3.0.0
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36846
CVE-2025-12773
Plain password is logged in the audit logs while executing 'update-reports-purge-settings.sh' script
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36847
CVE-2025-21991
Nessus detected vulnerability in the Brocade SANnav OVA base image (CVE-2025-21991)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36804
CVE-2024-3661, CVE-2024-11187, CVE-2024-12797
Rocky Linux Updates applied to SANnav
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36805
CVE-2025-26465
Vulnerability in OpenSSH when the VerifyHostKeyDNS option is enabled
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36806
CVE-2025-32728
The DisableForwarding directive does not fully adhere to the intended functionality as documented
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36639
CVE-2025-4207
PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36807
CVE-2024-7264
libcurl's ASN1 parser code has the GTime2str() function, used for parsing an ASN.1
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36808
CVE-2025-8713, CVE-2025-8714, CVE-2025-8715
Postgres vulnerabilities (CVE-2025-8713, CVE-2025-8714, CVE-2025-8715)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36809
CVE-2023-25194, CVE-2025-27819, CVE-2025-27818, CVE-2022-34917, CVE-2024-31141, CVE-2024-56128
Multiple Vulnerabilities in Apache Kafka
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36810
CVE-2024-9143
Low-level invalid GF(2^m) parameters lead to OOB memory access
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36811
CVE-2025-23165, CVE-2025-23166, CVE-2025-23167
Multiple Vulnerabilities in Node.js (Wednesday, May 14, 2025 Security Releases). Nessus Plugin ID 236766
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36812
CVE-2025-50059, CVE-2025-30749, CVE-2025-50106, CVE-2025-23166, CVE-2025-30754
Oracle Java SE Updates (July 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36813
CVEs addressed in SANnav v3.0.0
CVE-2025-12774
SQL queries with sensitive information printed in logs
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36848
CVE-2024-38808, CVE-2024-38809 and CVE-2024-22262
Spring Framework DoS (CVE-2024-38808, CVE-2024-38809 and CVE-2024-22262)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36814
CVE-2024-24549
DoS due to improper input validation vulnerability in Apache Tomcat
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36815
CVE-2025-4947, CVE-2025-5025
Curl vulnerabilities detected in SANnav images (CVE-2025-4947, CVE-2025-5025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36816
=======================================
Brocade Security Advisories posted on October 14, 2025
CVE addressed in SANnav v2.4.0a
CVE-2024-12243
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/36219
=======================================
Brocade Security Advisories posted on July 8, 2025
CVE addressed in SANnav v2.4.0a
CVE-2025-4662
Plaintext security passwords are logged in the audit logs while executing openssl cmd
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35908
CVE-2025-6390
Cleartext storage of sensitive information in Brocade SANnav server audit logs
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35909
CVE-2025-6392
Daily Data Dump Collector logs database password in cleartext when running docker exec commands
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35910
Multiple Rocky Linux updates applied to Brocade SANnav OVA 2.4.0a
OVA base image related vulnerabilities
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35918
CVE-2025-0395
GNU Glibc Vulnerable to Memory Corruption via Heap Buffer Overflow during 'assert()' Failure
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35919
CVE-2025-23083, CVE-2024-54534, CVE-2024-47606, CVE-2025-21587, CVE-2025-30698, CVE-2025-30691
Oracle Java SE Multiple Vulnerabilities (April 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35911
CVE-2025-0509, CVE-2025-21502
Oracle Java SE Multiple Vulnerabilities (January 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35912
CVE-2024-36138, CVE-2023-42950, CVE-2024-25062, CVE-2024-21235, CVE-2024-21210, CVE-2024-21211, CVE-2024-21208, CVE-2024-21217
Oracle Java SE Multiple Vulnerabilities (October 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35913
CVE-2025-0509, CVE-2025-21502
Azul Zulu Java Multiple Vulnerabilities (January 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35914
CVE-2024-36138, CVE-2023-42950, CVE-2024-25062, CVE-2024-21235, CVE-2024-21210, CVE-2024-21211, CVE-2024-21208, CVE-2024-21217
Azul Zulu Java Multiple Vulnerabilities (October 2025)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35915
CVE-2025-1094, CVE-2024-10979, CVE-2024-10978, CVE-2024-10977, CVE-2024-10976, CVE-2024-7348, CVE-2024-1597
Multiple vulnerabilities detected in PostgreSQL
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35916
CVE-2024-47561
Schema parsing in the Java SDK of Apache Avro 1.11.3 and previous versions allows bad actors to execute arbitrary code
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35917
CVE addressed in SANnav v2.4.0a and v2.3.1b
CVE-2022-48687
Linux Kernel IPv6 Segment Routing Vulnerable to Out-of-Bounds Read via Crafted Netlink Message in SRv6 Layer
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35920
=======================================
Brocade Security Advisories posted on February 27, 2025
CVEs addressed in SANnav v2.3.1b and v2.4.0
CVE-2024-32487
less Vulnerable to Arbitrary Code Execution via OS Command Execution via newline Character in Filename
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25432
CVE-2024-38428
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent
(PSIRT Risk: Low for SANnav)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25430
=======================================
Brocade Security Advisories posted on February 13, 2025
CVEs addressed in SANnav v2.3.1b and v2.4.0
ROCKY LINUX Upgrade for RLSA-2024:5530, RLSA-2024:5101, RLSA-2024:4583, RLSA-2024:3501, RLSA-2024:3513, RLSA-2024:3619, RLSA-2024:4349, RLSA-2024:4078, RLSA-2024:2758, RLSA-2024:2758
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25398
CVE-2025-1053
Encryption key is logged in the debug logs
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25399
CVE-2024-4282
Weak TLS Ciphers on Brocade OVA SSH port 22
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25400
CVE-2024-2240
Docker implementation in Brocade SANnav is missing audit rules
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25401
CVE-2024-10405
Weak TLS Ciphers on port 443 and 18082
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25402
CVE-2024-10404
Clear text password seen in switch-asset-collectors-mw for supportsave
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25403
CVE-2024-4317
PostgreSQL Vulnerable to Privilege Escalation via Improper Checks in 'pg_stats_ext' and 'pg_stats_ext_exprs' Functions
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25404
CVE-2024-2398, CVE-2024-2466, CVE-2024-2004, CVE-2024-0853
Multiple CURL vulnerabilities in Brocade SANnav OVA deployments before SANnav 2.3.1b
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25405
CVE-2024-0985
PostgreSQL Vulnerable to Privileged Execution of Arbitrary SQL due to Late Privilege Drop in 'REFRESH MATERIALIZED VIEW CONCURRENTLY'
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25406
CVE-2023-5870
PostgreSQL Vulnerable to Denial-of-Service (DoS) in 'pg_signal_backend()'
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25407
CVE-2022-38178
ISC BIND 9 Vulnerable to Denial-of-Service (DoS) via Memory Leaks in EdDSA DNSSEC Verification
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25408
AZUL Zulu Java -- July 2024 Update
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25409
Oracle Critical Patch Update Advisory -- July 2024
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25410
CVE-2024-25710, CVE-2024-26308
Apache Commons Vulnerabilities
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25411
CVE-2024-1597
PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25412
CVE-2023-34455
snappy-java Vulnerable to Denial-of-Service (DoS) due to Improper Input Validation in File 'SnappyInputStream.java'
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25413
CVE-2022-48174
Stack overflow vulnerability in ash.c:6030 in busybox before 1.35 can be executed from command to arbitrary code execution.
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25414
CVE-2022-28391
BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25415
=======================================
Previously Disclosed Security Advisories
Rocky Linux OVA updates: kernel (RLSA-2024:8856) expat (RLSA-2024:9502, RLSA-2024-6989) bzip2 (RLSA-2024:8922) krb5 (RLSA-2024:8860) and python3 (RLSA-2024:6975)
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25416
CVE-2024-29018
By registering a domain for which they control the authoritative nameservers, an attacker could arrange for a compromised container
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25073
CVE-2024-26923
Linux Kernel Vulnerable to Dangling Pointer via Garbage Collector Racing Against Connect() in AF_UNIX Module
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35818
CVE-2023-0394
Linux Kernel Vulnerable to Denial-of-Service (DoS) via NULL Pointer Dereference in 'rawv6_push_pending_frames()' Function in 'raw.c' File
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/35817
CVE-2022-48624
close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE
(PSIRT Risk for SANnav: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/24994
CVE-2024-6387
Remote Unauthorized Code Execution Vulnerability in openSSH server (regreSSHion)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/24691
CVE-2022-2068
openssl file names of certificates being hashed were possibly passed to a command executed through the shell
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22396
CVE-2024-2860
The Postgres implementation in Brocade SANnav versions before 2.3.0a is vulnerable to an incorrect local authentication
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/24260
CVE-2023-51385
OpenSSH is vulnerable to an OS command injection issue due to how user name and host name values are processed and referenced by expansion tokens.
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25238
CVE-2023-42795
Apache Tomcat - Information disclosure
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25158
CVE-2023-5869
Buffer overrun from integer overflow in array modification
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25092
CVE-2023-5868
PostgreSQL Memory disclosure in aggregate function calls
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25093
CVE-2024-20952, CVE-2024-20945, CVE-2024-20926, CVE-2024-20921, CVE-2024-20919, CVE-2024-20918
Oracle Critical Patch Update Advisory - January 2024
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25160
CVE-2023-22025, CVE-2023-22067, CVE-2023-22081
Azul Zulu Java Multiple Vulnerabilities (2023-10-17)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25159
CVE-2024-23653, CVE-2024-21626
Container vulnerabilities in Brocade SANnav docker containers
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/25074
CVE-2023-52160
The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/24987
CVE-2024-29969
TLS/SSL weak message authentication code ciphers are added by default for port 18082
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23251
CVE-2024-29968
SQL Table names, column names, and SQL queries are collected in DR standby Supportsave
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23253
CVE-2024-29966
hard-coded credential in the documentation that appear as the root password
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23255
CVE-2024-29961
Ping at regular intervals
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23246
CVE-2024-29959
Brocade Fabric OS switch encrypted passwords in the Brocade SANnav Standby node support save
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23243
CVE-2024-29958
Encryption key in the console
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23242
CVE-2024-29957
The encryption key is stored in the DR log files
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23241
CVE-2023-39417
Extension script @substitutions@ within quoting allow SQL injection
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23259
CVE-2024-29965
A local attacker can recover backup files, restore them to a new malicious appliance, and retrieve the passwords of all the switches
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23250
CVE-2024-29964
Brocade SANnav versions before v2.3.0a do not correctly set permissions on files, including docker files
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23249
CVE-2024-29962
Insecure file permission setting that makes files world-readable
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23248
CVE-2024-29960
Identical SSH keys utilized inside the OVA image
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23244
CVE-2024-29956
cleartext password in supportsave logs when a user schedules a switch Supportsave from Brocade SANnav
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23240
CVE-2024-29955
SANnav encrypted key in PostgreSQL startup logs
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23239
CVE-2024-29952
plaintext passwords storage in logs by manipulating command variables
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23238
CVE-2024-29951
SHA-1 hash in internal SSH ports that are not open to remote connection
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23237
CVE-2024-29950
The class FileTransfer implemented uses the ssh-rsa signature scheme
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23236
CVE-2024-4159
SANnav before v2.3.0a lacks protection mechanisms on port 2377/TCP and 7946/TCP
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23282
CVE-2023-34478
Apache Shiro, before 1.12.0 or 2.0.0-alpha-3, may be susceptible to a path traversal attack
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23256
CVE-2023-39410
Apache Avro Java SDK vulnerable to Improper Input Validation
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23262
CVE-2023-22006, CVE-2023-22036, CVE-2023-22041, CVE-2023-22043, CVE-2023-22044, CVE-2023-22045, CVE-2023-22049
Azul Zulu Java Multiple Vulnerabilities (July 2023 update)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23263
CVE-2023-22041, CVE-2023-25193, CVE-2023-22045, CVE-2023-22049, CVE-2023-22036, CVE-2023-22006
Oracle Java SE Multiple Vulnerabilities (July 2023 CPU)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23260
CVE-2023-20863
Spring Expression DoS Vulnerability
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23257
CVE-2023-20861
Spring Expression DoS Vulnerability
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23261
CVE-2024-29967
Docker instances inside the appliance have insecure mount points, allowing reading and writing access to sensitive files
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23254
CVE-2024-29963
Hardcoded TLS keys used by Docker
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23247
CVE-2024-4161
Syslog traffic sent in clear-text
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23284
CVE-2023-31424
Web authentication and authorization bypass
(PSIRT Risk: High)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22507
CVE-2024-2859
By default, SANnav OVA is shipped with root user login enabled
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/23245
CVE-2023-31925
Storage of clear text password in Brocade SANnav
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22506
CVE-2023-31423
Possible information exposure through log file vulnerability
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22508
CVE-2023-21830, CVE-2023-21835, CVE-2023-21843
Oracle Java SE Multiple Vulnerabilities (Jan 2023 CPU update)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22454
CVE-2022-43937
Sensitive fields are recorded in the debug-enabled logs
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22509
CVE-2022-41946
Vulnerable postgresql component found in SANnav RPM package
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22502
CVE-2022-40664
Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22449
CVE-2022-25647
The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22450
CVE-2022-21618, CVE-2022-21619, CVE-2022-21624, CVE-2022-21626, CVE-2022-21628, CVE-2022-39399
Azul Zulu Java Multiple Vulnerabilities (Oct 2022 update)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22461
CVE-2022-21540, CVE-2022-21541, CVE-2022-21549, CVE-2022-25647, CVE-2022-34169
Oracle Java SE Multiple Vulnerabilities (July 2022 CPU update)
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22463
CVE-2022-2625
PostgreSQL vulnerability in SANnav 2.2.0.2
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22465
CVE-2016-1000027
Spring Framework through 5.3.16 suffers from a potential remote code execution (RCE) issue if used for Java deserialization of untrusted data
(PSIRT Risk: Medium)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22456
CVE-2022-33980
Apache Commons Configuration performs variable interpolation, allowing properties to be dynamically evaluated and expanded
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22448
CVE-2022-22950
Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22503
CVE-2022-21449, CVE-2022-21476, CVE-2022-21426
Oracle Java SE Multiple Vulnerabilities (Apr 2022 CPU update)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22462
CVE-2022-21248 CVE-2022-21277 CVE-2022-21366 CVE-2022-21282 CVE-2022-21296 CVE-2022-21283 CVE-2022-21291 CVE-2022-21305 CVE-2022-21293 CVE-2022-21294 CVE-2022-21340 CVE-2022-21299 CVE-2022-21341 CVE-2022-21349 CVE-2022-21360 CVE-2022-21365
Azul Zulu Java Multiple Vulnerabilities (Jan 2022 Java update)
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22464
CVE-2018-17190
An improper access control vulnerability has been discovered in Apache Spark
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22460
CVE-2018-1273
Spring Data Commons, versions prior to 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22459
CVE-2017-7657
A remote attacker can supply specially crafted transfer-encoding chunks to Eclipse Jetty that may bypass the authorization checks of an intermediary caching proxy
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22458
CVE-2015-1315
Buffer overflow in Info-Zip UnZip 6.10b allows remote attackers to execute arbitrary code via a crafted string
(PSIRT Risk: Low)
https://support.broadcom.com/external/content/SecurityAdvisories/0/22457
Revision History
|
Version |
Change |
Date |
|
1.0 |
Initial Publication |
October 14, 2024 |
|
1.1 |
Additional BSAs for security vulnerabilities posted on November 2nd, 2024 for SANnav 2.3.1a and 2.3.0a |
November 12, 2024 |
|
1.2 |
Updated with CVE-2023-51385 posting |
January 7, 2025 |
|
2.0 |
Brocade SANnav 2.3.1b and 2.4.0 security postings |
February 13, 2025 |
|
2.1 |
Updated with CVE-2024-32487, CVE-2024-38428, CVE-2024-29018 postings |
February 27, 2025 |
|
2.2 |
Two BSA updates for SANnav Base OS (OVA deployment) releases |
June 10, 2025 |
|
2.3 |
Update SANnav 2.4.0a security postings |
July 8, 2025 |
|
3.0 |
Brocade SANnav 3.0.0 and 2.4.0b security postings |
January 27, 2026 |
|
3.1 |
Critical security BSA posting for SANnav 3.0.0 |
February 19, 2026 |
|
3.2 |
Additional security BSA postings for SANnav 3.0.0, 2.4.0b and 2.4.0a |
March 3, 2026 |
|
3.3 |
Brocade SANnav 3.0.0a and 3.0.1 security postings |
July 28, 2026 |
Disclaimer
THIS DOCUMENT IS PROVIDED ON AN AS-IS BASIS SOLELY FOR INFORMATIONAL PURPOSES AND DOES NOT IMPLY ANY KIND OF GUARANTY OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. YOUR USE OF THE INFORMATION CONTAINED HEREIN IS AT YOUR OWN RISK. ALL INFORMATION PROVIDED HEREIN IS BASED ON BROCADE'S CURRENT KNOWLEDGE AND UNDERSTANDING OF THE VULNERABILITY AND IMPACT TO BROCADE HARDWARE AND SOFTWARE PRODUCTS. BROCADE RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.