{"id":"CVE-2024-29963","aliases":["EUVD-2024-26937","GHSA-rq82-xjv7-57jq"],"status":"published","title":"Brocade SANnav contains hardcoded TLS keys used by Docker","description":"Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.","severity":{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0016,"percentile":0.05263,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2024-04-19T04:04:48Z","modified":"2026-06-17T07:23:26Z","products":[{"vendor":"broadcom","product":"brocade_sannav"},{"vendor":"brocade","product":"brocade sannav"},{"vendor":"brocade","product":"sannav"}],"references":[{"url":"https://support.broadcom.com/external/content/SecurityAdvisories/0/23247","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-29963"},{"url":"https://github.com/advisories/GHSA-rq82-xjv7-57jq"}],"sources":{"cve":[{"id":"CVE-2024-29963","title":"Brocade SANnav contains hardcoded TLS keys used by Docker","description":"\nBrocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.\n\n","status":"published","published":"2024-04-19T04:04:48.344Z","modified":"2024-08-02T01:17:58.554Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:15.337999Z"}],"euvd":[{"id":"EUVD-2024-26937","description":"\nBrocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.\n\n","status":"published","published":"2024-04-19T04:04:48Z","modified":"2024-08-02T01:17:58Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T03:50:25.628684Z"}],"ghsa":[{"id":"GHSA-rq82-xjv7-57jq","title":"Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded keys used by Docker to reach...","description":"Brocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded keys used by Docker to reach remote registries over TLS. TLS connections with an exposed key allow an attacker to MITM the traffic. \nNote: Brocade SANnav doesn't have access to remote Docker registries.","status":"published","published":"2024-04-19T06:30:27Z","modified":"2025-02-04T18:30:44Z","cvss":[{"version":"3.1","score":8.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:59:47.147393Z"}],"nvd":[{"id":"CVE-2024-29963","description":"\nBrocade SANnav OVA before v2.3.1, and v2.3.0a, contain hardcoded TLS keys used by Docker. Note: Brocade SANnav doesn't have access to remote Docker registries.\n\n","status":"published","published":"2024-04-19T04:15:10.793Z","modified":"2026-06-17T07:23:26.887Z","cvss":[{"version":"3.1","score":1.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":3.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:09:53.50104Z"}]}}