Impact of CVE-2021-31525 and CVE-2021-33194 on Mender

General Discussions
1

Hi there!

How do you consider the impact of CVE-2021-31525 [1] and CVE-2021-33194 [2] on Mender? Do you think this is critical?

Best regards

[1] NVD - CVE-2021-31525
[2] NVD - CVE-2021-33194

2

@kacf do you have any thoughts here?

3

The impact on the client is extremely low, as it only connects to the Mender server it trusts.
On the backend-side, it needs a bit of investigation to see which version is affected.
I’ll get back to this thread early next week.