pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
d4fbc9cb7f
vuln-list-alt/oval/p9/ALT-PU-2018-2426/definitions.json

214 lines
9.5 KiB
JSON
Raw Normal View History

ALT Vulnerability
2024-06-28 16:17:52 +03:00
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20182426",
"Version": "oval:org.altlinux.errata:def:20182426",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2018-2426: package `libgcrypt` update to version 1.8.3-alt3",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p9"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2018-2426",
"RefURL": "https://errata.altlinux.org/ALT-PU-2018-2426",
"Source": "ALTPU"
},
{
"RefID": "BDU:2018-00007",
"RefURL": "https://bdu.fstec.ru/vul/2018-00007",
"Source": "BDU"
},
{
"RefID": "BDU:2019-00510",
"RefURL": "https://bdu.fstec.ru/vul/2019-00510",
"Source": "BDU"
},
{
"RefID": "BDU:2020-01023",
"RefURL": "https://bdu.fstec.ru/vul/2020-01023",
"Source": "BDU"
},
{
"RefID": "CVE-2017-0379",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-0379",
"Source": "CVE"
},
{
"RefID": "CVE-2017-7526",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-7526",
"Source": "CVE"
},
{
"RefID": "CVE-2018-0495",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495",
"Source": "CVE"
},
{
"RefID": "CVE-2018-6829",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-6829",
"Source": "CVE"
}
],
"Description": "This update upgrades libgcrypt to version 1.8.3-alt3. \nSecurity Fix(es):\n\n * BDU:2018-00007: Уязвимость библиотеки libgcrypt11, связанная с отсутствием защиты служебных данных, позволяющая нарушителю нарушить конфиденциальность данных\n\n * BDU:2019-00510: Уязвимость функции _gcry_ecc_ecdsa_sign криптографической библиотеки Libgcrypt, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2020-01023: Уязвимость компонента cipher/elgamal.c криптографической библиотеки Libgcrypt, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * CVE-2017-0379: Libgcrypt before 1.8.1 does not properly consider Curve25519 side-channel attacks, which makes it easier for attackers to discover a secret key, related to cipher/ecc.c and mpi/ec.c.\n\n * CVE-2017-7526: libgcrypt before version 1.7.8 is vulnerable to a cache side-channel attack resulting into a complete break of RSA-1024 while using the left-to-right method for computing the sliding-window expansion. The same attack is believed to work on RSA-2048 with moderately more computation. This side-channel requires that attacker can run arbitrary software on the hardware where the private RSA key is used.\n\n * CVE-2018-0495: Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding during the signing process in the _gcry_ecc_ecdsa_sign function in cipher/ecc-ecdsa.c, aka the Return Of the Hidden Number Problem or ROHNP. To discover an ECDSA key, the attacker needs access to either the local machine or a different virtual machine on the same physical host.\n\n * CVE-2018-6829: cipher/elgamal.c in Libgcrypt through 1.8.2, when used to encrypt messages directly, improperly encodes plaintexts, which allows attackers to obtain sensitive information by reading ciphertext data (i.e., it does not have semantic security in face of a ciphertext-only attack). The Decisional Diffie-Hellman (DDH) assumption does not hold for Libgcrypt's ElGamal implementation.\n\n * #34383: включить описание хэш функции ГОСТ Р 34.11-2012 (Стрибог)",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2018-10-08"
},
"Updated": {
"Date": "2018-10-08"
},
"BDUs": [
{
"ID": "BDU:2018-00007",
"CVSS": "AV:N/AC:H/Au:S/C:C/I:N/A:N",
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2018-00007",
"Impact": "Low",
"Public": "20170629"
},
{
"ID": "BDU:2019-00510",
"CVSS": "AV:L/AC:M/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://bdu.fstec.ru/vul/2019-00510",
"Impact": "Low",
"Public": "20180613"
},
{
"ID": "BDU:2020-01023",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-327",
"Href": "https://bdu.fstec.ru/vul/2020-01023",
"Impact": "High",
"Public": "20180207"
}
],
"CVEs": [
{
"ID": "CVE-2017-0379",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-0379",
"Impact": "High",
"Public": "20170829"
},
{
"ID": "CVE-2017-7526",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"CWE": "CWE-310",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-7526",
"Impact": "Low",
"Public": "20180726"
},
{
"ID": "CVE-2018-0495",
"CVSS": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-203",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-0495",
"Impact": "Low",
"Public": "20180613"
},
{
"ID": "CVE-2018-6829",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-327",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-6829",
"Impact": "High",
"Public": "20180207"
}
],
"Bugzilla": [
{
"ID": "34383",
"Href": "https://bugzilla.altlinux.org/34383",
"Data": "включить описание хэш функции ГОСТ Р 34.11-2012 (Стрибог)"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:kworkstation:9",
"cpe:/o:alt:workstation:9",
"cpe:/o:alt:server:9",
"cpe:/o:alt:server-v:9",
"cpe:/o:alt:education:9",
"cpe:/o:alt:slinux:9",
"cpe:/o:alt:starterkit:p9",
"cpe:/o:alt:kworkstation:9.1",
"cpe:/o:alt:workstation:9.1",
"cpe:/o:alt:server:9.1",
"cpe:/o:alt:server-v:9.1",
"cpe:/o:alt:education:9.1",
"cpe:/o:alt:slinux:9.1",
"cpe:/o:alt:starterkit:9.1",
"cpe:/o:alt:kworkstation:9.2",
"cpe:/o:alt:workstation:9.2",
"cpe:/o:alt:server:9.2",
"cpe:/o:alt:server-v:9.2",
"cpe:/o:alt:education:9.2",
"cpe:/o:alt:slinux:9.2",
"cpe:/o:alt:starterkit:9.2"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:1001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20182426001",
"Comment": "gcrypt-utils is earlier than 0:1.8.3-alt3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182426002",
"Comment": "libgcrypt-devel is earlier than 0:1.8.3-alt3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182426003",
"Comment": "libgcrypt-devel-static is earlier than 0:1.8.3-alt3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20182426004",
"Comment": "libgcrypt20 is earlier than 0:1.8.3-alt3"
}
]
}
]
}
}
]
}
Reference in New Issue Copy Permalink