pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ALT Vulnerability

Browse Source
This commit is contained in:
Иван Пепеляев 2024-01-17 18:01:10 +00:00
parent d320441dc4
commit ca45b7027e
13 changed files with 574 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

77
oval/c10f2/ALT-PU-2024-1162/definitions.json Normal file
View File

@ -0,0 +1,77 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20241162",
"Version": "oval:org.altlinux.errata:def:20241162",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-1162: package `alterator-mirror` update to version 0.5.0-alt0.c10f2",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f2"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-1162",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-1162",
"Source": "ALTPU"
}
],
"Description": "This update upgrades alterator-mirror to version 0.5.0-alt0.c10f2. \nSecurity Fix(es):\n\n * #43503: Ошибка в регулярке для проверки rsync url",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2023 BaseALT Ltd.",
"Issued": {
"Date": "2024-01-17"
},
"Updated": {
"Date": "2024-01-17"
},
"bdu": null,
"Bugzilla": [
{
"Id": "43503",
"Href": "https://bugzilla.altlinux.org/43503",
"Data": "Ошибка в регулярке для проверки rsync url"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:5001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20241162001",
"Comment": "alterator-mirror is earlier than 0:0.5.0-alt0.c10f2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20241162002",
"Comment": "alterator-mirror-allowed is earlier than 0:0.5.0-alt0.c10f2"
}
]
}
]
}
}
]
}

40
oval/c10f2/ALT-PU-2024-1162/objects.json Normal file
View File

@ -0,0 +1,40 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:5001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20241162001",
"Version": "1",
"comment": "alterator-mirror is installed",
"Name": "alterator-mirror"
},
{
"ID": "oval:org.altlinux.errata:obj:20241162002",
"Version": "1",
"comment": "alterator-mirror-allowed is installed",
"Name": "alterator-mirror-allowed"
}
]
}

23
oval/c10f2/ALT-PU-2024-1162/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:5001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20241162001",
"Version": "1",
"Comment": "package EVR is earlier than 0:0.5.0-alt0.c10f2",
"Arch": {},
"Evr": {
"Text": "0:0.5.0-alt0.c10f2",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

42
oval/c10f2/ALT-PU-2024-1162/tests.json Normal file
View File

@ -0,0 +1,42 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:5001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f2' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:5001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:5001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20241162001",
"Version": "1",
"Check": "all",
"Comment": "alterator-mirror is earlier than 0:0.5.0-alt0.c10f2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20241162001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20241162001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20241162002",
"Version": "1",
"Check": "all",
"Comment": "alterator-mirror-allowed is earlier than 0:0.5.0-alt0.c10f2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20241162002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20241162001"
}
}
]
}

6
oval/p10/ALT-PU-2023-6074/definitions.json
View File

File diff suppressed because one or more lines are too long

106
oval/p10/ALT-PU-2024-1128/definitions.json Normal file
View File

@ -0,0 +1,106 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20241128",
"Version": "oval:org.altlinux.errata:def:20241128",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-1128: package `memtest86+` update to version 7.00-alt2",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p10"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-1128",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-1128",
"Source": "ALTPU"
}
],
"Description": "This update upgrades memtest86+ to version 7.00-alt2. \nSecurity Fix(es):\n\n * #49060: Why srpm build?\n\n * #49061: 7.00.unknown.x64",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2023 BaseALT Ltd.",
"Issued": {
"Date": "2024-01-17"
},
"Updated": {
"Date": "2024-01-17"
},
"bdu": null,
"Bugzilla": [
{
"Id": "49060",
"Href": "https://bugzilla.altlinux.org/49060",
"Data": "Why srpm build?"
},
{
"Id": "49061",
"Href": "https://bugzilla.altlinux.org/49061",
"Data": "7.00.unknown.x64"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:kworkstation:10",
"cpe:/o:alt:workstation:10",
"cpe:/o:alt:server:10",
"cpe:/o:alt:server-v:10",
"cpe:/o:alt:education:10",
"cpe:/o:alt:slinux:10",
"cpe:/o:alt:starterkit:p10",
"cpe:/o:alt:kworkstation:10.1",
"cpe:/o:alt:workstation:10.1",
"cpe:/o:alt:server:10.1",
"cpe:/o:alt:server-v:10.1",
"cpe:/o:alt:education:10.1",
"cpe:/o:alt:slinux:10.1",
"cpe:/o:alt:starterkit:10.1",
"cpe:/o:alt:kworkstation:10.2",
"cpe:/o:alt:workstation:10.2",
"cpe:/o:alt:server:10.2",
"cpe:/o:alt:server-v:10.2",
"cpe:/o:alt:education:10.2",
"cpe:/o:alt:slinux:10.2",
"cpe:/o:alt:starterkit:10.2"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:2001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20241128001",
"Comment": "memtest86+ is earlier than 0:7.00-alt2"
}
]
}
]
}
}
]
}

34
oval/p10/ALT-PU-2024-1128/objects.json Normal file
View File

@ -0,0 +1,34 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:2001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20241128001",
"Version": "1",
"comment": "memtest86+ is installed",
"Name": "memtest86+"
}
]
}

23
oval/p10/ALT-PU-2024-1128/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:2001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20241128001",
"Version": "1",
"Comment": "package EVR is earlier than 0:7.00-alt2",
"Arch": {},
"Evr": {
"Text": "0:7.00-alt2",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/p10/ALT-PU-2024-1128/tests.json Normal file
View File

@ -0,0 +1,30 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:2001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'p10' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:2001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:2001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20241128001",
"Version": "1",
"Check": "all",
"Comment": "memtest86+ is earlier than 0:7.00-alt2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20241128001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20241128001"
}
}
]
}

109
oval/p10/ALT-PU-2024-1163/definitions.json Normal file
View File

@ -0,0 +1,109 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20241163",
"Version": "oval:org.altlinux.errata:def:20241163",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-1163: package `fish` update to version 3.7.0-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p10"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-1163",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-1163",
"Source": "ALTPU"
},
{
"RefID": "CVE-2023-49284",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-49284",
"Source": "CVE"
}
],
"Description": "This update upgrades fish to version 3.7.0-alt1. \nSecurity Fix(es):\n\n * CVE-2023-49284: fish is a smart and user-friendly command line shell for macOS, Linux, and the rest of the family. fish shell uses certain Unicode non-characters internally for marking wildcards and expansions. It will incorrectly allow these markers to be read on command substitution output, rather than transforming them into a safe internal representation. While this may cause unexpected behavior with direct input (for example, echo \\UFDD2HOME has the same output as echo $HOME), this may become a minor security problem if the output is being fed from an external program into a command substitution where this output may not be expected. This design flaw was introduced in very early versions of fish, predating the version control system, and is thought to be present in every version of fish released in the last 15 years or more, although with different characters. Code execution does not appear to be possible, but denial of service (through large brace expansion) or information disclosure (such as variable expansion) is potentially possible under certain circumstances. fish shell 3.6.2 has been released to correct this issue. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2023 BaseALT Ltd.",
"Issued": {
"Date": "2024-01-17"
},
"Updated": {
"Date": "2024-01-17"
},
"bdu": null,
"Cves": [
{
"Cvss3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
"Cwe": "CWE-436",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-49284",
"Impact": "Low",
"Public": "20231205",
"CveID": "CVE-2023-49284"
}
],
"AffectedCpeList": {
"Cpe": [
"cpe:/o:alt:kworkstation:10",
"cpe:/o:alt:workstation:10",
"cpe:/o:alt:server:10",
"cpe:/o:alt:server-v:10",
"cpe:/o:alt:education:10",
"cpe:/o:alt:slinux:10",
"cpe:/o:alt:starterkit:p10",
"cpe:/o:alt:kworkstation:10.1",
"cpe:/o:alt:workstation:10.1",
"cpe:/o:alt:server:10.1",
"cpe:/o:alt:server-v:10.1",
"cpe:/o:alt:education:10.1",
"cpe:/o:alt:slinux:10.1",
"cpe:/o:alt:starterkit:10.1",
"cpe:/o:alt:kworkstation:10.2",
"cpe:/o:alt:workstation:10.2",
"cpe:/o:alt:server:10.2",
"cpe:/o:alt:server-v:10.2",
"cpe:/o:alt:education:10.2",
"cpe:/o:alt:slinux:10.2",
"cpe:/o:alt:starterkit:10.2"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:2001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20241163001",
"Comment": "fish is earlier than 0:3.7.0-alt1"
}
]
}
]
}
}
]
}

34
oval/p10/ALT-PU-2024-1163/objects.json Normal file
View File

@ -0,0 +1,34 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:2001",
"Version": "1",
"comment": "Evaluate `/etc/os-release` file content",
"Path": {
"dataType": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RpmInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20241163001",
"Version": "1",
"comment": "fish is installed",
"Name": "fish"
}
]
}

23
oval/p10/ALT-PU-2024-1163/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:2001",
"Version": "1",
"Text": {}
}
],
"RpmInfoState": [
{
"ID": "oval:org.altlinux.errata:ste:20241163001",
"Version": "1",
"Comment": "package EVR is earlier than 0:3.7.0-alt1",
"Arch": {},
"Evr": {
"Text": "0:3.7.0-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/p10/ALT-PU-2024-1163/tests.json Normal file
View File

@ -0,0 +1,30 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:2001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'p10' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:2001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:2001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20241163001",
"Version": "1",
"Check": "all",
"Comment": "fish is earlier than 0:3.7.0-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20241163001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20241163001"
}
}
]
}