<?xml version="1.0" encoding="UTF-8"?>
<cvrf:cvrfdoc xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
    <cvrf:DocumentTitle>Ripple20</cvrf:DocumentTitle>
    <cvrf:DocumentType>Fortinet PSIRT Advisories</cvrf:DocumentType>
    <cvrf:DocumentPublisher Type="Vendor">
        <cvrf:ContactDetails>
            Fortinet PSIRT Contact:
            Website: https://fortiguard.fortinet.com/faq/psirt-contact
        </cvrf:ContactDetails>
     </cvrf:DocumentPublisher>
    <cvrf:DocumentTracking>
        <cvrf:Identification>
            <cvrf:ID>FG-IR-20-104</cvrf:ID>
        </cvrf:Identification>
        <cvrf:Status>Final</cvrf:Status>
        <cvrf:Version>1</cvrf:Version>
        <cvrf:RevisionHistory>
            <cvrf:Revision>
                <cvrf:Number>1</cvrf:Number>
                <cvrf:Date>2020-07-30T00:00:00</cvrf:Date>
                <cvrf:Description>Current version</cvrf:Description>
        </cvrf:Revision>
       </cvrf:RevisionHistory>
        <cvrf:InitialReleaseDate>2020-07-30T00:00:00</cvrf:InitialReleaseDate>
        <cvrf:CurrentReleaseDate>2020-07-30T00:00:00</cvrf:CurrentReleaseDate>
    </cvrf:DocumentTracking>
    <cvrf:DocumentNotes>
        <cvrf:Note Title="Summary" Type="Summary" Ordinal="1">
            On June 16, 2020, cybersecurity researchers from JSOF published a set of 19 vulnerabilities, dubbed Ripple20 that are impacting the TCP/IP stack developed by Treck. A remote attacker can exploit some of these vulnerabilities to take control of an affected system.
        </cvrf:Note>
        <cvrf:Note Title="Impact" Type="General" Ordinal="2">
            Information disclosure
        </cvrf:Note>
        <cvrf:Note Title="Affected Products" Type="General" Ordinal="3">
            Fortinet products do not use the low-level TCP/IP software library developed by Treck, Inc and are therefore not impacted by these vulnerabilities.
        </cvrf:Note>
    </cvrf:DocumentNotes>
    <cvrf:DocumentReferences>
        <cvrf:Reference>
            <cvrf:URL>https://fortiguard.fortinet.com/psirt/FG-IR-20-104</cvrf:URL>
            <cvrf:Description>Ripple20</cvrf:Description>
        </cvrf:Reference>
        <cvrf:Reference>
            <cvrf:URL>https://www.jsof-tech.com/ripple20/</cvrf:URL>
            <cvrf:Description>https://www.jsof-tech.com/ripple20/</cvrf:Description>
        </cvrf:Reference>
    </cvrf:DocumentReferences>
    <Vulnerability Ordinal="1">
        <Title>Ripple20</Title>
        <cvrf:CVE>CVE-2020-11896</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11897</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11898</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11899</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11900</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11901</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11902</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11903</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11904</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11905</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11906</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11907</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11908</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11909</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11910</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11911</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11912</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11913</cvrf:CVE>
        <cvrf:CVE>CVE-2020-11914</cvrf:CVE>
        <CVSSScoreSets>
            <ScoreSetV3>
                <BaseScoreV3>9.8</BaseScoreV3>
                <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:X/RC:X</VectorV3>
            </ScoreSetV3>
        </CVSSScoreSets>
        <References Type="Self">
            <Reference>
                <URL>https://fortiguard.fortinet.com/psirt/FG-IR-20-104</URL>
                <Description>Ripple20</Description>
            </Reference>Reference>
            <Reference>
                <URL>https://www.jsof-tech.com/ripple20/</URL>
                <Description>https://www.jsof-tech.com/ripple20/</Description>
            </Reference>
        </References>
    </Vulnerability>
</cvrf:cvrfdoc>