diff --git a/oval/c10f1/ALT-PU-2024-13731/definitions.json b/oval/c10f1/ALT-PU-2024-13731/definitions.json new file mode 100644 index 0000000000..e3533fb65a --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13731/definitions.json @@ -0,0 +1,369 @@ +{ + "Definition": [ + { + "ID": "oval:org.altlinux.errata:def:202413731", + "Version": "oval:org.altlinux.errata:def:202413731", + "Class": "patch", + "Metadata": { + "Title": "ALT-PU-2024-13731: package `php8.2` update to version 8.2.24-alt1", + "AffectedList": [ + { + "Family": "unix", + "Platforms": [ + "ALT Linux branch c10f1" + ], + "Products": [ + "ALT SP Workstation", + "ALT SP Server" + ] + } + ], + "References": [ + { + "RefID": "ALT-PU-2024-13731", + "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13731", + "Source": "ALTPU" + }, + { + "RefID": "BDU:2024-03215", + "RefURL": "https://bdu.fstec.ru/vul/2024-03215", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-03785", + "RefURL": "https://bdu.fstec.ru/vul/2024-03785", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-04432", + "RefURL": "https://bdu.fstec.ru/vul/2024-04432", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-04846", + "RefURL": "https://bdu.fstec.ru/vul/2024-04846", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-05512", + "RefURL": "https://bdu.fstec.ru/vul/2024-05512", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-06520", + "RefURL": "https://bdu.fstec.ru/vul/2024-06520", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-07676", + "RefURL": "https://bdu.fstec.ru/vul/2024-07676", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-07677", + "RefURL": "https://bdu.fstec.ru/vul/2024-07677", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-07679", + "RefURL": "https://bdu.fstec.ru/vul/2024-07679", + "Source": "BDU" + }, + { + "RefID": "BDU:2024-07680", + "RefURL": "https://bdu.fstec.ru/vul/2024-07680", + "Source": "BDU" + }, + { + "RefID": "CVE-2024-1874", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-1874", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-2408", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-2408", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-2756", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-2756", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-3096", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-3096", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-4577", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-5458", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-5458", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-5585", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-5585", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-8925", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8925", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-8926", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8926", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-8927", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8927", + "Source": "CVE" + }, + { + "RefID": "CVE-2024-9026", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-9026", + "Source": "CVE" + } + ], + "Description": "This update upgrades php8.2 to version 8.2.24-alt1. \nSecurity Fix(es):\n\n * BDU:2024-03215: Уязвимость функции password_verify() интерпретатора языка программирования PHP, позволяющая нарушителю обойти процесс аутентификации и получить несанкционированный доступ к веб-приложению\n\n * BDU:2024-03785: Уязвимость интерпретатора языка программирования PHP, связанная с ошибочной обработкой файлов cookie, позволяющая нарушителю перехватить сеанс и получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-04432: Уязвимость интерпретатора языка программирования PHP, существующая из-за непринятия мер по нейтрализации специальных элементов, используемых в команде операционной системмы, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2024-04846: Уязвимость функции filter_var интерпретатора языка программирования PHP, позволяющая нарушителю подменить URL-адреса с ошибочными данными\n\n * BDU:2024-05512: Уязвимость функции proc_open() интерпретатора языка программирования PHP, позволяющая нарушителю выполнить произвольные команды\n\n * BDU:2024-06520: Уязвимость функции openssl_private_decrypt() компонента PKCS1 Padding Handler интерпретатора языка программирования PHP, позволяющая нарушителю реализовать атаку Марвина\n\n * BDU:2024-07676: Уязвимость интерпретатора языка программирования PHP, связанная с недостаточной проверкой входных данных, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2024-07677: Уязвимость интерпретатора языка программирования PHP, существующая из-за непринятия мер по нейтрализации специальных элементов, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2024-07679: Уязвимость сценария cgi.force_redirect интерпретатора языка программирования PHP, позволяющая нарушителю обойти существующие ограничения безопасности\n\n * BDU:2024-07680: Уязвимость интерпретатора языка программирования PHP, позволяющая нарушителю обойти существующие ограничения безопасности\n\n * CVE-2024-1874: In PHP versions 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell. \n\n\n\n * CVE-2024-2408: The openssl_private_decrypt function in PHP, when using PKCS1 padding (OPENSSL_PKCS1_PADDING, which is the default), is vulnerable to the Marvin Attack unless it is used with an OpenSSL version that includes the changes from this pull request: https://github.com/openssl/openssl/pull/13817 (rsa_pkcs1_implicit_rejection). These changes are part of OpenSSL 3.2 and have also been backported to stable versions of various Linux distributions, as well as to the PHP builds provided for Windows since the previous release. All distributors and builders should ensure that this version is used to prevent PHP from being vulnerable.\n\nPHP Windows builds for the versions 8.1.29, 8.2.20 and 8.3.8 and above include OpenSSL patches that fix the vulnerability.\n\n * CVE-2024-2756: Due to an incomplete fix to CVE-2022-31629 https://github.com/advisories/GHSA-c43m-486j-j32p , network and same-site attackers can set a standard insecure cookie in the victim's browser which is treated as a __Host- or __Secure- cookie by PHP applications. \n\n\n * CVE-2024-3096: In PHP  version 8.1.* before 8.1.28, 8.2.* before 8.2.18, 8.3.* before 8.3.5, if a password stored with password_hash() starts with a null byte (\\x00), testing a blank string as the password via password_verify() will incorrectly return true.\n\n\n\n * CVE-2024-4577: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows may use \"Best-Fit\" behavior to replace characters in command line given to Win32 API functions. PHP CGI module may misinterpret those characters as PHP options, which may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.\n\n * CVE-2024-5458: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, due to a code logic error, filtering functions such as filter_var when validating URLs (FILTER_VALIDATE_URL) for certain types of URLs the function will result in invalid user information (username + password part of URLs) being treated as valid user information. This may lead to the downstream code accepting invalid URLs as valid and parsing them incorrectly.\n\n * CVE-2024-5585: In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, the fix for CVE-2024-1874 does not work if the command name includes trailing spaces. Original issue: when using proc_open() command with array syntax, due to insufficient escaping, if the arguments of the executed command are controlled by a malicious user, the user can supply arguments that would execute arbitrary commands in Windows shell.\n\n * CVE-2024-8925: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, erroneous parsing of multipart form data contained in an HTTP POST request could lead to legitimate data not being processed. This could lead to malicious attacker able to control part of the submitted data being able to exclude portion of other data, potentially leading to erroneous application behavior.\n\n * CVE-2024-8926: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for  CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3  may still be bypassed and the same command injection related to Windows \"Best Fit\" codepage behavior can be achieved. This may allow a malicious user to pass options to PHP binary being run, and thus reveal the source code of scripts, run arbitrary PHP code on the server, etc.\n\n * CVE-2024-8927: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, HTTP_REDIRECT_STATUS variable is used to check whether or not CGI binary is being run by the HTTP server. However, in certain scenarios, the content of this variable can be controlled by the request submitter via HTTP headers, which can lead to cgi.force_redirect option not being correctly applied. In certain configurations this may lead to arbitrary file inclusion in PHP.\n\n * CVE-2024-9026: In PHP versions 8.1.* before 8.1.30, 8.2.* before 8.2.24, 8.3.* before 8.3.12, when using PHP-FPM SAPI and it is configured to catch workers output through catch_workers_output = yes, it may be possible to pollute the final log or remove up to 4 characters from the log messages by manipulating log message content. Additionally, if PHP-FPM is configured to use syslog output, it may be possible to further remove log data using the same vulnerability.\n\n * #51216: Отсутствие плагина auth_plugin_caching_sha2_password в драйвере mysqlnd для php8.1", + "Advisory": { + "From": "errata.altlinux.org", + "Severity": "Critical", + "Rights": "Copyright 2024 BaseALT Ltd.", + "Issued": { + "Date": "2024-10-15" + }, + "Updated": { + "Date": "2024-10-15" + }, + "BDUs": [ + { + "ID": "BDU:2024-03215", + "CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:N", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", + "CWE": "CWE-287, CWE-626", + "Href": "https://bdu.fstec.ru/vul/2024-03215", + "Impact": "Critical", + "Public": "20240411" + }, + { + "ID": "BDU:2024-03785", + "CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:N", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", + "CWE": "CWE-20", + "Href": "https://bdu.fstec.ru/vul/2024-03785", + "Impact": "Low", + "Public": "20240409" + }, + { + "ID": "BDU:2024-04432", + "CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:C", + "CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-78", + "Href": "https://bdu.fstec.ru/vul/2024-04432", + "Impact": "High", + "Public": "20240606" + }, + { + "ID": "BDU:2024-04846", + "CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "CWE": "CWE-345", + "Href": "https://bdu.fstec.ru/vul/2024-04846", + "Impact": "Low", + "Public": "20240609" + }, + { + "ID": "BDU:2024-05512", + "CVSS": "AV:N/AC:L/Au:S/C:C/I:C/A:C", + "CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-78, CWE-116", + "Href": "https://bdu.fstec.ru/vul/2024-05512", + "Impact": "High", + "Public": "20240609" + }, + { + "ID": "BDU:2024-06520", + "CVSS": "AV:N/AC:H/Au:N/C:C/I:N/A:N", + "CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", + "CWE": "CWE-203", + "Href": "https://bdu.fstec.ru/vul/2024-06520", + "Impact": "Low", + "Public": "20240609" + }, + { + "ID": "BDU:2024-07676", + "CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-20", + "Href": "https://bdu.fstec.ru/vul/2024-07676", + "Impact": "Critical", + "Public": "20240929" + }, + { + "ID": "BDU:2024-07677", + "CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-78", + "Href": "https://bdu.fstec.ru/vul/2024-07677", + "Impact": "Critical", + "Public": "20240929" + }, + { + "ID": "BDU:2024-07679", + "CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-254", + "Href": "https://bdu.fstec.ru/vul/2024-07679", + "Impact": "Critical", + "Public": "20240929" + }, + { + "ID": "BDU:2024-07680", + "CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-778", + "Href": "https://bdu.fstec.ru/vul/2024-07680", + "Impact": "Critical", + "Public": "20240929" + } + ], + "CVEs": [ + { + "ID": "CVE-2024-1874", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-1874", + "Impact": "None", + "Public": "20240429" + }, + { + "ID": "CVE-2024-2408", + "CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", + "CWE": "CWE-203", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-2408", + "Impact": "Low", + "Public": "20240609" + }, + { + "ID": "CVE-2024-2756", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-2756", + "Impact": "None", + "Public": "20240429" + }, + { + "ID": "CVE-2024-3096", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-3096", + "Impact": "None", + "Public": "20240429" + }, + { + "ID": "CVE-2024-4577", + "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-78", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-4577", + "Impact": "Critical", + "Public": "20240609" + }, + { + "ID": "CVE-2024-5458", + "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", + "CWE": "CWE-345", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-5458", + "Impact": "Low", + "Public": "20240609" + }, + { + "ID": "CVE-2024-5585", + "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", + "CWE": "CWE-116", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-5585", + "Impact": "High", + "Public": "20240609" + }, + { + "ID": "CVE-2024-8925", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8925", + "Impact": "None", + "Public": "20241008" + }, + { + "ID": "CVE-2024-8926", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8926", + "Impact": "None", + "Public": "20241008" + }, + { + "ID": "CVE-2024-8927", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8927", + "Impact": "None", + "Public": "20241008" + }, + { + "ID": "CVE-2024-9026", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-9026", + "Impact": "None", + "Public": "20241008" + } + ], + "Bugzilla": [ + { + "ID": "51216", + "Href": "https://bugzilla.altlinux.org/51216", + "Data": "Отсутствие плагина auth_plugin_caching_sha2_password в драйвере mysqlnd для php8.1" + } + ], + "AffectedCPEs": { + "CPEs": [ + "cpe:/o:alt:spworkstation:10", + "cpe:/o:alt:spserver:10" + ] + } + } + }, + "Criteria": { + "Operator": "AND", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:4001", + "Comment": "ALT Linux must be installed" + } + ], + "Criterias": [ + { + "Operator": "OR", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:202413731001", + "Comment": "php8.2 is earlier than 0:8.2.24-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413731002", + "Comment": "php8.2-devel is earlier than 0:8.2.24-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413731003", + "Comment": "php8.2-libs is earlier than 0:8.2.24-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413731004", + "Comment": "php8.2-mysqlnd is earlier than 0:8.2.24-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413731005", + "Comment": "php8.2-openssl is earlier than 0:8.2.24-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413731006", + "Comment": "rpm-build-php8.2-version is earlier than 0:8.2.24-alt1" + } + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13731/objects.json b/oval/c10f1/ALT-PU-2024-13731/objects.json new file mode 100644 index 0000000000..9a3b4f5c9f --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13731/objects.json @@ -0,0 +1,64 @@ +{ + "TextFileContent54Objects": [ + { + "ID": "oval:org.altlinux.errata:obj:4001", + "Version": "1", + "Comment": "Evaluate `/etc/os-release` file content", + "Path": { + "Datatype": "string", + "Text": "/etc" + }, + "Filepath": { + "Datatype": "string", + "Text": "os-release" + }, + "Pattern": { + "Datatype": "string", + "Operation": "pattern match", + "Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)" + }, + "Instance": { + "Datatype": "int", + "Text": "1" + } + } + ], + "RPMInfoObjects": [ + { + "ID": "oval:org.altlinux.errata:obj:202413731001", + "Version": "1", + "Comment": "php8.2 is installed", + "Name": "php8.2" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413731002", + "Version": "1", + "Comment": "php8.2-devel is installed", + "Name": "php8.2-devel" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413731003", + "Version": "1", + "Comment": "php8.2-libs is installed", + "Name": "php8.2-libs" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413731004", + "Version": "1", + "Comment": "php8.2-mysqlnd is installed", + "Name": "php8.2-mysqlnd" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413731005", + "Version": "1", + "Comment": "php8.2-openssl is installed", + "Name": "php8.2-openssl" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413731006", + "Version": "1", + "Comment": "rpm-build-php8.2-version is installed", + "Name": "rpm-build-php8.2-version" + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13731/states.json b/oval/c10f1/ALT-PU-2024-13731/states.json new file mode 100644 index 0000000000..1b7782bec2 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13731/states.json @@ -0,0 +1,23 @@ +{ + "TextFileContent54State": [ + { + "ID": "oval:org.altlinux.errata:ste:4001", + "Version": "1", + "Text": {} + } + ], + "RPMInfoStates": [ + { + "ID": "oval:org.altlinux.errata:ste:202413731001", + "Version": "1", + "Comment": "package EVR is earlier than 0:8.2.24-alt1", + "Arch": {}, + "EVR": { + "Text": "0:8.2.24-alt1", + "Datatype": "evr_string", + "Operation": "less than" + }, + "Subexpression": {} + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13731/tests.json b/oval/c10f1/ALT-PU-2024-13731/tests.json new file mode 100644 index 0000000000..20b3b97d96 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13731/tests.json @@ -0,0 +1,90 @@ +{ + "TextFileContent54Tests": [ + { + "ID": "oval:org.altlinux.errata:tst:4001", + "Version": "1", + "Check": "all", + "Comment": "ALT Linux based on branch 'c10f1' must be installed", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:4001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:4001" + } + } + ], + "RPMInfoTests": [ + { + "ID": "oval:org.altlinux.errata:tst:202413731001", + "Version": "1", + "Check": "all", + "Comment": "php8.2 is earlier than 0:8.2.24-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413731001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413731001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413731002", + "Version": "1", + "Check": "all", + "Comment": "php8.2-devel is earlier than 0:8.2.24-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413731002" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413731001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413731003", + "Version": "1", + "Check": "all", + "Comment": "php8.2-libs is earlier than 0:8.2.24-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413731003" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413731001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413731004", + "Version": "1", + "Check": "all", + "Comment": "php8.2-mysqlnd is earlier than 0:8.2.24-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413731004" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413731001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413731005", + "Version": "1", + "Check": "all", + "Comment": "php8.2-openssl is earlier than 0:8.2.24-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413731005" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413731001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413731006", + "Version": "1", + "Check": "all", + "Comment": "rpm-build-php8.2-version is earlier than 0:8.2.24-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413731006" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413731001" + } + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13733/definitions.json b/oval/c10f1/ALT-PU-2024-13733/definitions.json new file mode 100644 index 0000000000..5cd351b040 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13733/definitions.json @@ -0,0 +1,77 @@ +{ + "Definition": [ + { + "ID": "oval:org.altlinux.errata:def:202413733", + "Version": "oval:org.altlinux.errata:def:202413733", + "Class": "patch", + "Metadata": { + "Title": "ALT-PU-2024-13733: package `php8.2-xhprof` update to version 2.3.10-alt2.24", + "AffectedList": [ + { + "Family": "unix", + "Platforms": [ + "ALT Linux branch c10f1" + ], + "Products": [ + "ALT SP Workstation", + "ALT SP Server" + ] + } + ], + "References": [ + { + "RefID": "ALT-PU-2024-13733", + "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13733", + "Source": "ALTPU" + } + ], + "Description": "This update upgrades php8.2-xhprof to version 2.3.10-alt2.24. \nSecurity Fix(es):\n\n * #50919: Непрописанный файловый конфликт с пакетом php8.1-xhprof", + "Advisory": { + "From": "errata.altlinux.org", + "Severity": "Low", + "Rights": "Copyright 2024 BaseALT Ltd.", + "Issued": { + "Date": "2024-10-15" + }, + "Updated": { + "Date": "2024-10-15" + }, + "BDUs": null, + "Bugzilla": [ + { + "ID": "50919", + "Href": "https://bugzilla.altlinux.org/50919", + "Data": "Непрописанный файловый конфликт с пакетом php8.1-xhprof" + } + ], + "AffectedCPEs": { + "CPEs": [ + "cpe:/o:alt:spworkstation:10", + "cpe:/o:alt:spserver:10" + ] + } + } + }, + "Criteria": { + "Operator": "AND", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:4001", + "Comment": "ALT Linux must be installed" + } + ], + "Criterias": [ + { + "Operator": "OR", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:202413733001", + "Comment": "php8.2-xhprof is earlier than 1:2.3.10-alt2.24" + } + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13733/objects.json b/oval/c10f1/ALT-PU-2024-13733/objects.json new file mode 100644 index 0000000000..f8dbeb3823 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13733/objects.json @@ -0,0 +1,34 @@ +{ + "TextFileContent54Objects": [ + { + "ID": "oval:org.altlinux.errata:obj:4001", + "Version": "1", + "Comment": "Evaluate `/etc/os-release` file content", + "Path": { + "Datatype": "string", + "Text": "/etc" + }, + "Filepath": { + "Datatype": "string", + "Text": "os-release" + }, + "Pattern": { + "Datatype": "string", + "Operation": "pattern match", + "Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)" + }, + "Instance": { + "Datatype": "int", + "Text": "1" + } + } + ], + "RPMInfoObjects": [ + { + "ID": "oval:org.altlinux.errata:obj:202413733001", + "Version": "1", + "Comment": "php8.2-xhprof is installed", + "Name": "php8.2-xhprof" + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13733/states.json b/oval/c10f1/ALT-PU-2024-13733/states.json new file mode 100644 index 0000000000..f56af77501 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13733/states.json @@ -0,0 +1,23 @@ +{ + "TextFileContent54State": [ + { + "ID": "oval:org.altlinux.errata:ste:4001", + "Version": "1", + "Text": {} + } + ], + "RPMInfoStates": [ + { + "ID": "oval:org.altlinux.errata:ste:202413733001", + "Version": "1", + "Comment": "package EVR is earlier than 1:2.3.10-alt2.24", + "Arch": {}, + "EVR": { + "Text": "1:2.3.10-alt2.24", + "Datatype": "evr_string", + "Operation": "less than" + }, + "Subexpression": {} + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13733/tests.json b/oval/c10f1/ALT-PU-2024-13733/tests.json new file mode 100644 index 0000000000..cd30f64a10 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13733/tests.json @@ -0,0 +1,30 @@ +{ + "TextFileContent54Tests": [ + { + "ID": "oval:org.altlinux.errata:tst:4001", + "Version": "1", + "Check": "all", + "Comment": "ALT Linux based on branch 'c10f1' must be installed", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:4001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:4001" + } + } + ], + "RPMInfoTests": [ + { + "ID": "oval:org.altlinux.errata:tst:202413733001", + "Version": "1", + "Check": "all", + "Comment": "php8.2-xhprof is earlier than 1:2.3.10-alt2.24", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413733001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413733001" + } + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13734/definitions.json b/oval/c10f1/ALT-PU-2024-13734/definitions.json new file mode 100644 index 0000000000..635445d9d8 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13734/definitions.json @@ -0,0 +1,77 @@ +{ + "Definition": [ + { + "ID": "oval:org.altlinux.errata:def:202413734", + "Version": "oval:org.altlinux.errata:def:202413734", + "Class": "patch", + "Metadata": { + "Title": "ALT-PU-2024-13734: package `php8.2-swoole` update to version 5.1.2-alt1.24", + "AffectedList": [ + { + "Family": "unix", + "Platforms": [ + "ALT Linux branch c10f1" + ], + "Products": [ + "ALT SP Workstation", + "ALT SP Server" + ] + } + ], + "References": [ + { + "RefID": "ALT-PU-2024-13734", + "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13734", + "Source": "ALTPU" + } + ], + "Description": "This update upgrades php8.2-swoole to version 5.1.2-alt1.24. \nSecurity Fix(es):\n\n * #49121: /usr/lib64/php/8.3.1/extensions/swoole.so.so: cannot open shared object file: No such file or directory", + "Advisory": { + "From": "errata.altlinux.org", + "Severity": "Low", + "Rights": "Copyright 2024 BaseALT Ltd.", + "Issued": { + "Date": "2024-10-15" + }, + "Updated": { + "Date": "2024-10-15" + }, + "BDUs": null, + "Bugzilla": [ + { + "ID": "49121", + "Href": "https://bugzilla.altlinux.org/49121", + "Data": "/usr/lib64/php/8.3.1/extensions/swoole.so.so: cannot open shared object file: No such file or directory" + } + ], + "AffectedCPEs": { + "CPEs": [ + "cpe:/o:alt:spworkstation:10", + "cpe:/o:alt:spserver:10" + ] + } + } + }, + "Criteria": { + "Operator": "AND", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:4001", + "Comment": "ALT Linux must be installed" + } + ], + "Criterias": [ + { + "Operator": "OR", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:202413734001", + "Comment": "php8.2-swoole is earlier than 0:5.1.2-alt1.24" + } + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13734/objects.json b/oval/c10f1/ALT-PU-2024-13734/objects.json new file mode 100644 index 0000000000..fe0eb90ca1 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13734/objects.json @@ -0,0 +1,34 @@ +{ + "TextFileContent54Objects": [ + { + "ID": "oval:org.altlinux.errata:obj:4001", + "Version": "1", + "Comment": "Evaluate `/etc/os-release` file content", + "Path": { + "Datatype": "string", + "Text": "/etc" + }, + "Filepath": { + "Datatype": "string", + "Text": "os-release" + }, + "Pattern": { + "Datatype": "string", + "Operation": "pattern match", + "Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)" + }, + "Instance": { + "Datatype": "int", + "Text": "1" + } + } + ], + "RPMInfoObjects": [ + { + "ID": "oval:org.altlinux.errata:obj:202413734001", + "Version": "1", + "Comment": "php8.2-swoole is installed", + "Name": "php8.2-swoole" + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13734/states.json b/oval/c10f1/ALT-PU-2024-13734/states.json new file mode 100644 index 0000000000..ff8104fcc0 --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13734/states.json @@ -0,0 +1,23 @@ +{ + "TextFileContent54State": [ + { + "ID": "oval:org.altlinux.errata:ste:4001", + "Version": "1", + "Text": {} + } + ], + "RPMInfoStates": [ + { + "ID": "oval:org.altlinux.errata:ste:202413734001", + "Version": "1", + "Comment": "package EVR is earlier than 0:5.1.2-alt1.24", + "Arch": {}, + "EVR": { + "Text": "0:5.1.2-alt1.24", + "Datatype": "evr_string", + "Operation": "less than" + }, + "Subexpression": {} + } + ] +} \ No newline at end of file diff --git a/oval/c10f1/ALT-PU-2024-13734/tests.json b/oval/c10f1/ALT-PU-2024-13734/tests.json new file mode 100644 index 0000000000..5dd1c46a2a --- /dev/null +++ b/oval/c10f1/ALT-PU-2024-13734/tests.json @@ -0,0 +1,30 @@ +{ + "TextFileContent54Tests": [ + { + "ID": "oval:org.altlinux.errata:tst:4001", + "Version": "1", + "Check": "all", + "Comment": "ALT Linux based on branch 'c10f1' must be installed", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:4001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:4001" + } + } + ], + "RPMInfoTests": [ + { + "ID": "oval:org.altlinux.errata:tst:202413734001", + "Version": "1", + "Check": "all", + "Comment": "php8.2-swoole is earlier than 0:5.1.2-alt1.24", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413734001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413734001" + } + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13254/definitions.json b/oval/p10/ALT-PU-2024-13254/definitions.json new file mode 100644 index 0000000000..8ccad9eb11 --- /dev/null +++ b/oval/p10/ALT-PU-2024-13254/definitions.json @@ -0,0 +1,121 @@ +{ + "Definition": [ + { + "ID": "oval:org.altlinux.errata:def:202413254", + "Version": "oval:org.altlinux.errata:def:202413254", + "Class": "patch", + "Metadata": { + "Title": "ALT-PU-2024-13254: package `bluez` update to version 5.77-alt0.p10.1", + "AffectedList": [ + { + "Family": "unix", + "Platforms": [ + "ALT Linux branch p10" + ], + "Products": [ + "ALT Server", + "ALT Virtualization Server", + "ALT Workstation", + "ALT Workstation K", + "ALT Education", + "Simply Linux", + "Starterkit" + ] + } + ], + "References": [ + { + "RefID": "ALT-PU-2024-13254", + "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13254", + "Source": "ALTPU" + } + ], + "Description": "This update upgrades bluez to version 5.77-alt0.p10.1. \nSecurity Fix(es):\n\n * #50904: При сборке используются неправильные макросы", + "Advisory": { + "From": "errata.altlinux.org", + "Severity": "Low", + "Rights": "Copyright 2024 BaseALT Ltd.", + "Issued": { + "Date": "2024-10-15" + }, + "Updated": { + "Date": "2024-10-15" + }, + "BDUs": null, + "Bugzilla": [ + { + "ID": "50904", + "Href": "https://bugzilla.altlinux.org/50904", + "Data": "При сборке используются неправильные макросы" + } + ], + "AffectedCPEs": { + "CPEs": [ + "cpe:/o:alt:kworkstation:10", + "cpe:/o:alt:workstation:10", + "cpe:/o:alt:server:10", + "cpe:/o:alt:server-v:10", + "cpe:/o:alt:education:10", + "cpe:/o:alt:slinux:10", + "cpe:/o:alt:starterkit:p10", + "cpe:/o:alt:kworkstation:10.1", + "cpe:/o:alt:workstation:10.1", + "cpe:/o:alt:server:10.1", + "cpe:/o:alt:server-v:10.1", + "cpe:/o:alt:education:10.1", + "cpe:/o:alt:slinux:10.1", + "cpe:/o:alt:starterkit:10.1", + "cpe:/o:alt:kworkstation:10.2", + "cpe:/o:alt:workstation:10.2", + "cpe:/o:alt:server:10.2", + "cpe:/o:alt:server-v:10.2", + "cpe:/o:alt:education:10.2", + "cpe:/o:alt:slinux:10.2", + "cpe:/o:alt:starterkit:10.2" + ] + } + } + }, + "Criteria": { + "Operator": "AND", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:2001", + "Comment": "ALT Linux must be installed" + } + ], + "Criterias": [ + { + "Operator": "OR", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:202413254001", + "Comment": "bluez is earlier than 0:5.77-alt0.p10.1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413254002", + "Comment": "bluez-btpclient is earlier than 0:5.77-alt0.p10.1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413254003", + "Comment": "bluez-cups is earlier than 0:5.77-alt0.p10.1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413254004", + "Comment": "libbluez is earlier than 0:5.77-alt0.p10.1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413254005", + "Comment": "libbluez-devel is earlier than 0:5.77-alt0.p10.1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413254006", + "Comment": "zsh-completion-bluez is earlier than 0:5.77-alt0.p10.1" + } + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13254/objects.json b/oval/p10/ALT-PU-2024-13254/objects.json new file mode 100644 index 0000000000..fb96252223 --- /dev/null +++ b/oval/p10/ALT-PU-2024-13254/objects.json @@ -0,0 +1,64 @@ +{ + "TextFileContent54Objects": [ + { + "ID": "oval:org.altlinux.errata:obj:2001", + "Version": "1", + "Comment": "Evaluate `/etc/os-release` file content", + "Path": { + "Datatype": "string", + "Text": "/etc" + }, + "Filepath": { + "Datatype": "string", + "Text": "os-release" + }, + "Pattern": { + "Datatype": "string", + "Operation": "pattern match", + "Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*" + }, + "Instance": { + "Datatype": "int", + "Text": "1" + } + } + ], + "RPMInfoObjects": [ + { + "ID": "oval:org.altlinux.errata:obj:202413254001", + "Version": "1", + "Comment": "bluez is installed", + "Name": "bluez" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413254002", + "Version": "1", + "Comment": "bluez-btpclient is installed", + "Name": "bluez-btpclient" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413254003", + "Version": "1", + "Comment": "bluez-cups is installed", + "Name": "bluez-cups" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413254004", + "Version": "1", + "Comment": "libbluez is installed", + "Name": "libbluez" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413254005", + "Version": "1", + "Comment": "libbluez-devel is installed", + "Name": "libbluez-devel" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413254006", + "Version": "1", + "Comment": "zsh-completion-bluez is installed", + "Name": "zsh-completion-bluez" + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13254/states.json b/oval/p10/ALT-PU-2024-13254/states.json new file mode 100644 index 0000000000..d5c86770e6 --- /dev/null +++ b/oval/p10/ALT-PU-2024-13254/states.json @@ -0,0 +1,23 @@ +{ + "TextFileContent54State": [ + { + "ID": "oval:org.altlinux.errata:ste:2001", + "Version": "1", + "Text": {} + } + ], + "RPMInfoStates": [ + { + "ID": "oval:org.altlinux.errata:ste:202413254001", + "Version": "1", + "Comment": "package EVR is earlier than 0:5.77-alt0.p10.1", + "Arch": {}, + "EVR": { + "Text": "0:5.77-alt0.p10.1", + "Datatype": "evr_string", + "Operation": "less than" + }, + "Subexpression": {} + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13254/tests.json b/oval/p10/ALT-PU-2024-13254/tests.json new file mode 100644 index 0000000000..027b744b4f --- /dev/null +++ b/oval/p10/ALT-PU-2024-13254/tests.json @@ -0,0 +1,90 @@ +{ + "TextFileContent54Tests": [ + { + "ID": "oval:org.altlinux.errata:tst:2001", + "Version": "1", + "Check": "all", + "Comment": "ALT Linux based on branch 'p10' must be installed", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:2001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:2001" + } + } + ], + "RPMInfoTests": [ + { + "ID": "oval:org.altlinux.errata:tst:202413254001", + "Version": "1", + "Check": "all", + "Comment": "bluez is earlier than 0:5.77-alt0.p10.1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413254001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413254001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413254002", + "Version": "1", + "Check": "all", + "Comment": "bluez-btpclient is earlier than 0:5.77-alt0.p10.1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413254002" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413254001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413254003", + "Version": "1", + "Check": "all", + "Comment": "bluez-cups is earlier than 0:5.77-alt0.p10.1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413254003" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413254001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413254004", + "Version": "1", + "Check": "all", + "Comment": "libbluez is earlier than 0:5.77-alt0.p10.1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413254004" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413254001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413254005", + "Version": "1", + "Check": "all", + "Comment": "libbluez-devel is earlier than 0:5.77-alt0.p10.1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413254005" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413254001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413254006", + "Version": "1", + "Check": "all", + "Comment": "zsh-completion-bluez is earlier than 0:5.77-alt0.p10.1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413254006" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413254001" + } + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13594/definitions.json b/oval/p10/ALT-PU-2024-13594/definitions.json new file mode 100644 index 0000000000..288d30cb8b --- /dev/null +++ b/oval/p10/ALT-PU-2024-13594/definitions.json @@ -0,0 +1,148 @@ +{ + "Definition": [ + { + "ID": "oval:org.altlinux.errata:def:202413594", + "Version": "oval:org.altlinux.errata:def:202413594", + "Class": "patch", + "Metadata": { + "Title": "ALT-PU-2024-13594: package `aprutil1` update to version 1.6.3-alt1", + "AffectedList": [ + { + "Family": "unix", + "Platforms": [ + "ALT Linux branch p10" + ], + "Products": [ + "ALT Server", + "ALT Virtualization Server", + "ALT Workstation", + "ALT Workstation K", + "ALT Education", + "Simply Linux", + "Starterkit" + ] + } + ], + "References": [ + { + "RefID": "ALT-PU-2024-13594", + "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13594", + "Source": "ALTPU" + }, + { + "RefID": "BDU:2024-02969", + "RefURL": "https://bdu.fstec.ru/vul/2024-02969", + "Source": "BDU" + }, + { + "RefID": "CVE-2022-25147", + "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-25147", + "Source": "CVE" + } + ], + "Description": "This update upgrades aprutil1 to version 1.6.3-alt1. \nSecurity Fix(es):\n\n * BDU:2024-02969: УУязвимость функции apr_base64 библиотеки Apache Portable Runtime (APR), позволяющая нарушителю выполнить произвольный код\n\n * CVE-2022-25147: Integer Overflow or Wraparound vulnerability in apr_base64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer.\n\n\n\n\nThis issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.\n\n", + "Advisory": { + "From": "errata.altlinux.org", + "Severity": "Low", + "Rights": "Copyright 2024 BaseALT Ltd.", + "Issued": { + "Date": "2024-10-15" + }, + "Updated": { + "Date": "2024-10-15" + }, + "BDUs": [ + { + "ID": "BDU:2024-02969", + "CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:P", + "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", + "CWE": "CWE-190", + "Href": "https://bdu.fstec.ru/vul/2024-02969", + "Impact": "Low", + "Public": "20230131" + } + ], + "CVEs": [ + { + "ID": "CVE-2022-25147", + "CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L", + "CWE": "CWE-190", + "Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-25147", + "Impact": "Low", + "Public": "20230131" + } + ], + "AffectedCPEs": { + "CPEs": [ + "cpe:/o:alt:kworkstation:10", + "cpe:/o:alt:workstation:10", + "cpe:/o:alt:server:10", + "cpe:/o:alt:server-v:10", + "cpe:/o:alt:education:10", + "cpe:/o:alt:slinux:10", + "cpe:/o:alt:starterkit:p10", + "cpe:/o:alt:kworkstation:10.1", + "cpe:/o:alt:workstation:10.1", + "cpe:/o:alt:server:10.1", + "cpe:/o:alt:server-v:10.1", + "cpe:/o:alt:education:10.1", + "cpe:/o:alt:slinux:10.1", + "cpe:/o:alt:starterkit:10.1", + "cpe:/o:alt:kworkstation:10.2", + "cpe:/o:alt:workstation:10.2", + "cpe:/o:alt:server:10.2", + "cpe:/o:alt:server-v:10.2", + "cpe:/o:alt:education:10.2", + "cpe:/o:alt:slinux:10.2", + "cpe:/o:alt:starterkit:10.2" + ] + } + } + }, + "Criteria": { + "Operator": "AND", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:2001", + "Comment": "ALT Linux must be installed" + } + ], + "Criterias": [ + { + "Operator": "OR", + "Criterions": [ + { + "TestRef": "oval:org.altlinux.errata:tst:202413594001", + "Comment": "libaprutil1 is earlier than 0:1.6.3-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413594002", + "Comment": "libaprutil1-devel is earlier than 0:1.6.3-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413594003", + "Comment": "libaprutil1-ldap is earlier than 0:1.6.3-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413594004", + "Comment": "libaprutil1-mysql is earlier than 0:1.6.3-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413594005", + "Comment": "libaprutil1-odbc is earlier than 0:1.6.3-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413594006", + "Comment": "libaprutil1-pgsql is earlier than 0:1.6.3-alt1" + }, + { + "TestRef": "oval:org.altlinux.errata:tst:202413594007", + "Comment": "libaprutil1-sqlite3 is earlier than 0:1.6.3-alt1" + } + ] + } + ] + } + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13594/objects.json b/oval/p10/ALT-PU-2024-13594/objects.json new file mode 100644 index 0000000000..c4f2a9f05e --- /dev/null +++ b/oval/p10/ALT-PU-2024-13594/objects.json @@ -0,0 +1,70 @@ +{ + "TextFileContent54Objects": [ + { + "ID": "oval:org.altlinux.errata:obj:2001", + "Version": "1", + "Comment": "Evaluate `/etc/os-release` file content", + "Path": { + "Datatype": "string", + "Text": "/etc" + }, + "Filepath": { + "Datatype": "string", + "Text": "os-release" + }, + "Pattern": { + "Datatype": "string", + "Operation": "pattern match", + "Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*" + }, + "Instance": { + "Datatype": "int", + "Text": "1" + } + } + ], + "RPMInfoObjects": [ + { + "ID": "oval:org.altlinux.errata:obj:202413594001", + "Version": "1", + "Comment": "libaprutil1 is installed", + "Name": "libaprutil1" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413594002", + "Version": "1", + "Comment": "libaprutil1-devel is installed", + "Name": "libaprutil1-devel" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413594003", + "Version": "1", + "Comment": "libaprutil1-ldap is installed", + "Name": "libaprutil1-ldap" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413594004", + "Version": "1", + "Comment": "libaprutil1-mysql is installed", + "Name": "libaprutil1-mysql" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413594005", + "Version": "1", + "Comment": "libaprutil1-odbc is installed", + "Name": "libaprutil1-odbc" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413594006", + "Version": "1", + "Comment": "libaprutil1-pgsql is installed", + "Name": "libaprutil1-pgsql" + }, + { + "ID": "oval:org.altlinux.errata:obj:202413594007", + "Version": "1", + "Comment": "libaprutil1-sqlite3 is installed", + "Name": "libaprutil1-sqlite3" + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13594/states.json b/oval/p10/ALT-PU-2024-13594/states.json new file mode 100644 index 0000000000..3ff1131642 --- /dev/null +++ b/oval/p10/ALT-PU-2024-13594/states.json @@ -0,0 +1,23 @@ +{ + "TextFileContent54State": [ + { + "ID": "oval:org.altlinux.errata:ste:2001", + "Version": "1", + "Text": {} + } + ], + "RPMInfoStates": [ + { + "ID": "oval:org.altlinux.errata:ste:202413594001", + "Version": "1", + "Comment": "package EVR is earlier than 0:1.6.3-alt1", + "Arch": {}, + "EVR": { + "Text": "0:1.6.3-alt1", + "Datatype": "evr_string", + "Operation": "less than" + }, + "Subexpression": {} + } + ] +} \ No newline at end of file diff --git a/oval/p10/ALT-PU-2024-13594/tests.json b/oval/p10/ALT-PU-2024-13594/tests.json new file mode 100644 index 0000000000..bbaadaf724 --- /dev/null +++ b/oval/p10/ALT-PU-2024-13594/tests.json @@ -0,0 +1,102 @@ +{ + "TextFileContent54Tests": [ + { + "ID": "oval:org.altlinux.errata:tst:2001", + "Version": "1", + "Check": "all", + "Comment": "ALT Linux based on branch 'p10' must be installed", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:2001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:2001" + } + } + ], + "RPMInfoTests": [ + { + "ID": "oval:org.altlinux.errata:tst:202413594001", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1 is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594001" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413594002", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1-devel is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594002" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413594003", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1-ldap is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594003" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413594004", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1-mysql is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594004" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413594005", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1-odbc is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594005" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413594006", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1-pgsql is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594006" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + }, + { + "ID": "oval:org.altlinux.errata:tst:202413594007", + "Version": "1", + "Check": "all", + "Comment": "libaprutil1-sqlite3 is earlier than 0:1.6.3-alt1", + "Object": { + "ObjectRef": "oval:org.altlinux.errata:obj:202413594007" + }, + "State": { + "StateRef": "oval:org.altlinux.errata:ste:202413594001" + } + } + ] +} \ No newline at end of file