ALT Vulnerability

2024-06-07 09:02:30 +00:00 · 2024-06-07 09:02:30 +00:00 · 4c07b101db
commit 4c07b101db
parent 4c4b7f2359
10 changed files with 268 additions and 10 deletions
--- a/oval/c10f1/ALT-PU-2024-6194/definitions.json
+++ b/oval/c10f1/ALT-PU-2024-6194/definitions.json
@ -82,9 +82,10 @@
            },
            {
              "ID": "CVE-2024-27316",
-              "CWE": "CWE-400",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-770",
              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-27316",
-              "Impact": "None",
+              "Impact": "High",
              "Public": "20240404"
            }
          ],
--- a/oval/c10f1/ALT-PU-2024-8086/definitions.json
+++ b/oval/c10f1/ALT-PU-2024-8086/definitions.json
@ -30,7 +30,7 @@
            "Source": "CVE"
          }
        ],
-        "Description": "This update upgrades unbound to version 1.20.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-33655: description unavailable",
+        "Description": "This update upgrades unbound to version 1.20.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-33655: The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue.",
        "Advisory": {
          "From": "errata.altlinux.org",
          "Severity": "Low",
@ -42,6 +42,14 @@
            "Date": "2024-05-22"
          },
          "BDUs": null,
+          "CVEs": [
+            {
+              "ID": "CVE-2024-33655",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33655",
+              "Impact": "None",
+              "Public": "20240606"
+            }
+          ],
          "AffectedCPEs": {
            "CPEs": [
              "cpe:/o:alt:spworkstation:10",
--- a/oval/c10f1/ALT-PU-2024-8418/definitions.json
+++ b/oval/c10f1/ALT-PU-2024-8418/definitions.json
@ -0,0 +1,108 @@
+{
+  "Definition": [
+    {
+      "ID": "oval:org.altlinux.errata:def:20248418",
+      "Version": "oval:org.altlinux.errata:def:20248418",
+      "Class": "patch",
+      "Metadata": {
+        "Title": "ALT-PU-2024-8418: package `openstack-glance` update to version 26.0.0-alt0.1.c10f2",
+        "AffectedList": [
+          {
+            "Family": "unix",
+            "Platforms": [
+              "ALT Linux branch c10f1"
+            ],
+            "Products": [
+              "ALT SP Workstation",
+              "ALT SP Server"
+            ]
+          }
+        ],
+        "References": [
+          {
+            "RefID": "ALT-PU-2024-8418",
+            "RefURL": "https://errata.altlinux.org/ALT-PU-2024-8418",
+            "Source": "ALTPU"
+          },
+          {
+            "RefID": "BDU:2023-00689",
+            "RefURL": "https://bdu.fstec.ru/vul/2023-00689",
+            "Source": "BDU"
+          },
+          {
+            "RefID": "CVE-2022-47951",
+            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-47951",
+            "Source": "CVE"
+          }
+        ],
+        "Description": "This update upgrades openstack-glance to version 26.0.0-alt0.1.c10f2. \nSecurity Fix(es):\n\n * BDU:2023-00689: Уязвимость сервиса блочного хранения данных Openstack Cinder, связанная с использованием файлов и каталогов, доступных внешним сторонам, позволяющая нарушителю раскрыть защищаемую информацию\n\n * CVE-2022-47951: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.",
+        "Advisory": {
+          "From": "errata.altlinux.org",
+          "Severity": "High",
+          "Rights": "Copyright 2024 BaseALT Ltd.",
+          "Issued": {
+            "Date": "2024-06-07"
+          },
+          "Updated": {
+            "Date": "2024-06-07"
+          },
+          "BDUs": [
+            {
+              "ID": "BDU:2023-00689",
+              "CVSS": "AV:N/AC:H/Au:N/C:C/I:P/A:P",
+              "CVSS3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
+              "CWE": "CWE-552",
+              "Href": "https://bdu.fstec.ru/vul/2023-00689",
+              "Impact": "High",
+              "Public": "20230124"
+            }
+          ],
+          "CVEs": [
+            {
+              "ID": "CVE-2022-47951",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
+              "CWE": "CWE-22",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-47951",
+              "Impact": "Low",
+              "Public": "20230126"
+            }
+          ],
+          "AffectedCPEs": {
+            "CPEs": [
+              "cpe:/o:alt:spworkstation:10",
+              "cpe:/o:alt:spserver:10"
+            ]
+          }
+        }
+      },
+      "Criteria": {
+        "Operator": "AND",
+        "Criterions": [
+          {
+            "TestRef": "oval:org.altlinux.errata:tst:4001",
+            "Comment": "ALT Linux must be installed"
+          }
+        ],
+        "Criterias": [
+          {
+            "Operator": "OR",
+            "Criterions": [
+              {
+                "TestRef": "oval:org.altlinux.errata:tst:20248418001",
+                "Comment": "openstack-glance is earlier than 1:26.0.0-alt0.1.c10f2"
+              },
+              {
+                "TestRef": "oval:org.altlinux.errata:tst:20248418002",
+                "Comment": "python3-module-glance is earlier than 1:26.0.0-alt0.1.c10f2"
+              },
+              {
+                "TestRef": "oval:org.altlinux.errata:tst:20248418003",
+                "Comment": "python3-module-glance-tests is earlier than 1:26.0.0-alt0.1.c10f2"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}
--- a/oval/c10f1/ALT-PU-2024-8418/objects.json
+++ b/oval/c10f1/ALT-PU-2024-8418/objects.json
@ -0,0 +1,46 @@
+{
+  "TextFileContent54Objects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:4001",
+      "Version": "1",
+      "Comment": "Evaluate `/etc/os-release` file content",
+      "Path": {
+        "Datatype": "string",
+        "Text": "/etc"
+      },
+      "Filepath": {
+        "Datatype": "string",
+        "Text": "os-release"
+      },
+      "Pattern": {
+        "Datatype": "string",
+        "Operation": "pattern match",
+        "Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
+      },
+      "Instance": {
+        "Datatype": "int",
+        "Text": "1"
+      }
+    }
+  ],
+  "RPMInfoObjects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:20248418001",
+      "Version": "1",
+      "Comment": "openstack-glance is installed",
+      "Name": "openstack-glance"
+    },
+    {
+      "ID": "oval:org.altlinux.errata:obj:20248418002",
+      "Version": "1",
+      "Comment": "python3-module-glance is installed",
+      "Name": "python3-module-glance"
+    },
+    {
+      "ID": "oval:org.altlinux.errata:obj:20248418003",
+      "Version": "1",
+      "Comment": "python3-module-glance-tests is installed",
+      "Name": "python3-module-glance-tests"
+    }
+  ]
+}
--- a/oval/c10f1/ALT-PU-2024-8418/states.json
+++ b/oval/c10f1/ALT-PU-2024-8418/states.json
@ -0,0 +1,23 @@
+{
+  "TextFileContent54State": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:4001",
+      "Version": "1",
+      "Text": {}
+    }
+  ],
+  "RPMInfoStates": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:20248418001",
+      "Version": "1",
+      "Comment": "package EVR is earlier than 1:26.0.0-alt0.1.c10f2",
+      "Arch": {},
+      "EVR": {
+        "Text": "1:26.0.0-alt0.1.c10f2",
+        "Datatype": "evr_string",
+        "Operation": "less than"
+      },
+      "Subexpression": {}
+    }
+  ]
+}
--- a/oval/c10f1/ALT-PU-2024-8418/tests.json
+++ b/oval/c10f1/ALT-PU-2024-8418/tests.json
@ -0,0 +1,54 @@
+{
+  "TextFileContent54Tests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:4001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "ALT Linux based on branch 'c10f1' must be installed",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:4001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:4001"
+      }
+    }
+  ],
+  "RPMInfoTests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:20248418001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "openstack-glance is earlier than 1:26.0.0-alt0.1.c10f2",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:20248418001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:20248418001"
+      }
+    },
+    {
+      "ID": "oval:org.altlinux.errata:tst:20248418002",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "python3-module-glance is earlier than 1:26.0.0-alt0.1.c10f2",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:20248418002"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:20248418001"
+      }
+    },
+    {
+      "ID": "oval:org.altlinux.errata:tst:20248418003",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "python3-module-glance-tests is earlier than 1:26.0.0-alt0.1.c10f2",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:20248418003"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:20248418001"
+      }
+    }
+  ]
+}
--- a/oval/c10f2/ALT-PU-2024-5993/definitions.json
+++ b/oval/c10f2/ALT-PU-2024-5993/definitions.json
@ -39,7 +39,7 @@
        "Description": "This update upgrades apache2 to version 2.4.59-alt1. \nSecurity Fix(es):\n\n * CVE-2023-38709: Faulty input validation in the core of Apache allows malicious or exploitable backend/content generators to split HTTP responses.\n\nThis issue affects Apache HTTP Server: through 2.4.58.\n\n\n * CVE-2024-24795: HTTP Response splitting in multiple modules in Apache HTTP Server allows an attacker that can inject malicious response headers into backend applications to cause an HTTP desynchronization attack.\n\nUsers are recommended to upgrade to version 2.4.59, which fixes this issue.\n\n * CVE-2024-27316: HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. If a client does not stop sending headers, this leads to memory exhaustion.",
        "Advisory": {
          "From": "errata.altlinux.org",
-          "Severity": "Low",
+          "Severity": "High",
          "Rights": "Copyright 2024 BaseALT Ltd.",
          "Issued": {
            "Date": "2024-04-05"
@ -63,9 +63,10 @@
            },
            {
              "ID": "CVE-2024-27316",
-              "CWE": "CWE-400",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-770",
              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-27316",
-              "Impact": "None",
+              "Impact": "High",
              "Public": "20240404"
            }
          ],
--- a/oval/c10f2/ALT-PU-2024-8015/definitions.json
+++ b/oval/c10f2/ALT-PU-2024-8015/definitions.json
@ -26,7 +26,7 @@
            "Source": "CVE"
          }
        ],
-        "Description": "This update upgrades unbound to version 1.20.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-33655: description unavailable",
+        "Description": "This update upgrades unbound to version 1.20.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-33655: The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue.",
        "Advisory": {
          "From": "errata.altlinux.org",
          "Severity": "Low",
@ -38,6 +38,14 @@
            "Date": "2024-05-21"
          },
          "BDUs": null,
+          "CVEs": [
+            {
+              "ID": "CVE-2024-33655",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33655",
+              "Impact": "None",
+              "Public": "20240606"
+            }
+          ],
          "AffectedCPEs": {
            "CPEs": [
              "cpe:/o:alt:spworkstation:10",
--- a/oval/c9f2/ALT-PU-2024-6193/definitions.json
+++ b/oval/c9f2/ALT-PU-2024-6193/definitions.json
@ -82,9 +82,10 @@
            },
            {
              "ID": "CVE-2024-27316",
-              "CWE": "CWE-400",
+              "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-770",
              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-27316",
-              "Impact": "None",
+              "Impact": "High",
              "Public": "20240404"
            }
          ],
--- a/oval/c9f2/ALT-PU-2024-8011/definitions.json
+++ b/oval/c9f2/ALT-PU-2024-8011/definitions.json
@ -30,7 +30,7 @@
            "Source": "CVE"
          }
        ],
-        "Description": "This update upgrades unbound to version 1.20.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-33655: description unavailable",
+        "Description": "This update upgrades unbound to version 1.20.0-alt1. \nSecurity Fix(es):\n\n * CVE-2024-33655: The DNS protocol in RFC 1035 and updates allows remote attackers to cause a denial of service (resource consumption) by arranging for DNS queries to be accumulated for seconds, such that responses are later sent in a pulsing burst (which can be considered traffic amplification in some cases), aka the \"DNSBomb\" issue.",
        "Advisory": {
          "From": "errata.altlinux.org",
          "Severity": "Low",
@ -42,6 +42,14 @@
            "Date": "2024-05-21"
          },
          "BDUs": null,
+          "CVEs": [
+            {
+              "ID": "CVE-2024-33655",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33655",
+              "Impact": "None",
+              "Public": "20240606"
+            }
+          ],
          "AffectedCPEs": {
            "CPEs": [
              "cpe:/o:alt:spworkstation:8.4",