{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2022-3675",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2022-3675",
    "idYear": 2022,
    "status": "PUBLISHED",
    "publishedAt": "2022-11-03T17:25:02.823Z",
    "updatedAt": "2025-05-02T18:53:10.153Z",
    "importedAt": "2026-10-24T01:56:45.230Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": null,
      "summary": "Fedora CoreOS supports setting a GRUB bootloader password\nusing a Butane config. When this feature is enabled, GRUB requires a password to access the\nGRUB command-line, modify kernel command-line arguments, or boot\nnon-default OSTree deployments.  Recent Fedora CoreOS releases have a\nmisconfiguration which allows booting non-default OSTree deployments\nwithout entering a password.  This allows someone with access to the\nGRUB menu to boot into an older version of Fedora CoreOS, reverting\nany security fixes that have recently been applied to the machine.  A\npassword is still required to modify kernel command-line arguments and\nto access the GRUB command line.\n\n\n\n",
      "affected": [
        {
          "vendor": "Fedora Project",
          "product": "CoreOS",
          "packageName": "coreos-assembler",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "testing 36.20220906.2.0 and later",
              "status": "affected",
              "versionType": "fix",
              "lessThan": "testing 36.20221030.2.0 "
            },
            {
              "version": "next 36.20220906.1.0 and later",
              "status": "affected",
              "versionType": "fix",
              "lessThan": "next 37.20221031.1.0"
            },
            {
              "version": "stable 36.20220820.3.0 and later",
              "status": "affected",
              "versionType": "fix",
              "lessThan": "stable 36.20221014.3.0"
            }
          ]
        }
      ]
    }
  }
}