pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ALT Vulnerability

Browse Source
This commit is contained in:
Иван Пепеляев 2024-05-21 09:02:10 +00:00
parent 818ad7bf50
commit e390d6f7c4
20 changed files with 1681 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

130
oval/c10f1/ALT-PU-2024-7927/definitions.json Normal file
View File

@ -0,0 +1,130 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20247927",
"Version": "oval:org.altlinux.errata:def:20247927",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-7927: package `postgresql15-1C` update to version 15.7-alt0.p10.1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-7927",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7927",
"Source": "ALTPU"
},
{
"RefID": "BDU:2024-03569",
"RefURL": "https://bdu.fstec.ru/vul/2024-03569",
"Source": "BDU"
},
{
"RefID": "CVE-2024-4317",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-4317",
"Source": "CVE"
}
],
"Description": "This update upgrades postgresql15-1C to version 15.7-alt0.p10.1. \nSecurity Fix(es):\n\n * BDU:2024-03569: Уязвимость системных представлений pg_stats_ext, pg_stats_ext_exprs СУБД PostgreSQL, позволяющая нарушителю повысить свои привилегии\n\n * CVE-2024-4317: Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2024-05-21"
},
"Updated": {
"Date": "2024-05-21"
},
"BDUs": [
{
"ID": "BDU:2024-03569",
"CVSS": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-264, CWE-862",
"Href": "https://bdu.fstec.ru/vul/2024-03569",
"Impact": "Low",
"Public": "20240509"
}
],
"CVEs": [
{
"ID": "CVE-2024-4317",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-4317",
"Impact": "None",
"Public": "20240514"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20247927001",
"Comment": "postgresql15-1C is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927002",
"Comment": "postgresql15-1C-contrib is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927003",
"Comment": "postgresql15-1C-docs is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927004",
"Comment": "postgresql15-1C-llvmjit is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927005",
"Comment": "postgresql15-1C-perl is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927006",
"Comment": "postgresql15-1C-python is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927007",
"Comment": "postgresql15-1C-server is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927008",
"Comment": "postgresql15-1C-server-devel is earlier than 0:15.7-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247927009",
"Comment": "postgresql15-1C-tcl is earlier than 0:15.7-alt0.p10.1"
}
]
}
]
}
}
]
}

82
oval/c10f1/ALT-PU-2024-7927/objects.json Normal file
View File

@ -0,0 +1,82 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"Comment": "Evaluate `/etc/os-release` file content",
"Path": {
"Datatype": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RPMInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20247927001",
"Version": "1",
"Comment": "postgresql15-1C is installed",
"Name": "postgresql15-1C"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927002",
"Version": "1",
"Comment": "postgresql15-1C-contrib is installed",
"Name": "postgresql15-1C-contrib"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927003",
"Version": "1",
"Comment": "postgresql15-1C-docs is installed",
"Name": "postgresql15-1C-docs"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927004",
"Version": "1",
"Comment": "postgresql15-1C-llvmjit is installed",
"Name": "postgresql15-1C-llvmjit"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927005",
"Version": "1",
"Comment": "postgresql15-1C-perl is installed",
"Name": "postgresql15-1C-perl"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927006",
"Version": "1",
"Comment": "postgresql15-1C-python is installed",
"Name": "postgresql15-1C-python"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927007",
"Version": "1",
"Comment": "postgresql15-1C-server is installed",
"Name": "postgresql15-1C-server"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927008",
"Version": "1",
"Comment": "postgresql15-1C-server-devel is installed",
"Name": "postgresql15-1C-server-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20247927009",
"Version": "1",
"Comment": "postgresql15-1C-tcl is installed",
"Name": "postgresql15-1C-tcl"
}
]
}

23
oval/c10f1/ALT-PU-2024-7927/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RPMInfoStates": [
{
"ID": "oval:org.altlinux.errata:ste:20247927001",
"Version": "1",
"Comment": "package EVR is earlier than 0:15.7-alt0.p10.1",
"Arch": {},
"EVR": {
"Text": "0:15.7-alt0.p10.1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

126
oval/c10f1/ALT-PU-2024-7927/tests.json Normal file
View File

@ -0,0 +1,126 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20247927001",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927002",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-contrib is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927003",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-docs is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927004",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-llvmjit is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927005",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-perl is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927006",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-python is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927007",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-server is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927008",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-server-devel is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247927009",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-1C-tcl is earlier than 0:15.7-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247927009"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247927001"
}
}
]
}

166
oval/c10f1/ALT-PU-2024-7929/definitions.json Normal file
View File

@ -0,0 +1,166 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20247929",
"Version": "oval:org.altlinux.errata:def:20247929",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-7929: package `postgresql15` update to version 15.7-alt0.c10f1.1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-7929",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7929",
"Source": "ALTPU"
},
{
"RefID": "BDU:2024-03569",
"RefURL": "https://bdu.fstec.ru/vul/2024-03569",
"Source": "BDU"
},
{
"RefID": "CVE-2024-4317",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-4317",
"Source": "CVE"
}
],
"Description": "This update upgrades postgresql15 to version 15.7-alt0.c10f1.1. \nSecurity Fix(es):\n\n * BDU:2024-03569: Уязвимость системных представлений pg_stats_ext, pg_stats_ext_exprs СУБД PostgreSQL, позволяющая нарушителю повысить свои привилегии\n\n * CVE-2024-4317: Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2024-05-21"
},
"Updated": {
"Date": "2024-05-21"
},
"BDUs": [
{
"ID": "BDU:2024-03569",
"CVSS": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-264, CWE-862",
"Href": "https://bdu.fstec.ru/vul/2024-03569",
"Impact": "Low",
"Public": "20240509"
}
],
"CVEs": [
{
"ID": "CVE-2024-4317",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-4317",
"Impact": "None",
"Public": "20240514"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20247929001",
"Comment": "libecpg6 is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929002",
"Comment": "libecpg6-devel is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929003",
"Comment": "libecpg6-devel-static is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929004",
"Comment": "libpq5 is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929005",
"Comment": "libpq5-devel is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929006",
"Comment": "libpq5-devel-static is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929007",
"Comment": "postgresql-devel is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929008",
"Comment": "postgresql-devel-static is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929009",
"Comment": "postgresql15 is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929010",
"Comment": "postgresql15-contrib is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929011",
"Comment": "postgresql15-docs is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929012",
"Comment": "postgresql15-llvmjit is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929013",
"Comment": "postgresql15-perl is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929014",
"Comment": "postgresql15-python is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929015",
"Comment": "postgresql15-server is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929016",
"Comment": "postgresql15-server-devel is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929017",
"Comment": "postgresql15-tcl is earlier than 0:15.7-alt0.c10f1.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247929018",
"Comment": "rpm-macros-postgresql is earlier than 0:15.7-alt0.c10f1.1"
}
]
}
]
}
}
]
}

136
oval/c10f1/ALT-PU-2024-7929/objects.json Normal file
View File

@ -0,0 +1,136 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"Comment": "Evaluate `/etc/os-release` file content",
"Path": {
"Datatype": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RPMInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20247929001",
"Version": "1",
"Comment": "libecpg6 is installed",
"Name": "libecpg6"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929002",
"Version": "1",
"Comment": "libecpg6-devel is installed",
"Name": "libecpg6-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929003",
"Version": "1",
"Comment": "libecpg6-devel-static is installed",
"Name": "libecpg6-devel-static"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929004",
"Version": "1",
"Comment": "libpq5 is installed",
"Name": "libpq5"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929005",
"Version": "1",
"Comment": "libpq5-devel is installed",
"Name": "libpq5-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929006",
"Version": "1",
"Comment": "libpq5-devel-static is installed",
"Name": "libpq5-devel-static"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929007",
"Version": "1",
"Comment": "postgresql-devel is installed",
"Name": "postgresql-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929008",
"Version": "1",
"Comment": "postgresql-devel-static is installed",
"Name": "postgresql-devel-static"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929009",
"Version": "1",
"Comment": "postgresql15 is installed",
"Name": "postgresql15"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929010",
"Version": "1",
"Comment": "postgresql15-contrib is installed",
"Name": "postgresql15-contrib"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929011",
"Version": "1",
"Comment": "postgresql15-docs is installed",
"Name": "postgresql15-docs"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929012",
"Version": "1",
"Comment": "postgresql15-llvmjit is installed",
"Name": "postgresql15-llvmjit"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929013",
"Version": "1",
"Comment": "postgresql15-perl is installed",
"Name": "postgresql15-perl"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929014",
"Version": "1",
"Comment": "postgresql15-python is installed",
"Name": "postgresql15-python"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929015",
"Version": "1",
"Comment": "postgresql15-server is installed",
"Name": "postgresql15-server"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929016",
"Version": "1",
"Comment": "postgresql15-server-devel is installed",
"Name": "postgresql15-server-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929017",
"Version": "1",
"Comment": "postgresql15-tcl is installed",
"Name": "postgresql15-tcl"
},
{
"ID": "oval:org.altlinux.errata:obj:20247929018",
"Version": "1",
"Comment": "rpm-macros-postgresql is installed",
"Name": "rpm-macros-postgresql"
}
]
}

23
oval/c10f1/ALT-PU-2024-7929/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RPMInfoStates": [
{
"ID": "oval:org.altlinux.errata:ste:20247929001",
"Version": "1",
"Comment": "package EVR is earlier than 0:15.7-alt0.c10f1.1",
"Arch": {},
"EVR": {
"Text": "0:15.7-alt0.c10f1.1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

234
oval/c10f1/ALT-PU-2024-7929/tests.json Normal file
View File

@ -0,0 +1,234 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20247929001",
"Version": "1",
"Check": "all",
"Comment": "libecpg6 is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929002",
"Version": "1",
"Check": "all",
"Comment": "libecpg6-devel is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929003",
"Version": "1",
"Check": "all",
"Comment": "libecpg6-devel-static is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929004",
"Version": "1",
"Check": "all",
"Comment": "libpq5 is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929005",
"Version": "1",
"Check": "all",
"Comment": "libpq5-devel is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929006",
"Version": "1",
"Check": "all",
"Comment": "libpq5-devel-static is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929007",
"Version": "1",
"Check": "all",
"Comment": "postgresql-devel is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929008",
"Version": "1",
"Check": "all",
"Comment": "postgresql-devel-static is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929009",
"Version": "1",
"Check": "all",
"Comment": "postgresql15 is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929009"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929010",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-contrib is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929010"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929011",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-docs is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929011"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929012",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-llvmjit is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929012"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929013",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-perl is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929013"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929014",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-python is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929014"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929015",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-server is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929015"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929016",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-server-devel is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929016"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929017",
"Version": "1",
"Check": "all",
"Comment": "postgresql15-tcl is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929017"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247929018",
"Version": "1",
"Check": "all",
"Comment": "rpm-macros-postgresql is earlier than 0:15.7-alt0.c10f1.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247929018"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247929001"
}
}
]
}

130
oval/c10f1/ALT-PU-2024-7930/definitions.json Normal file
View File

@ -0,0 +1,130 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20247930",
"Version": "oval:org.altlinux.errata:def:20247930",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-7930: package `postgresql14` update to version 14.12-alt0.p10.1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-7930",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7930",
"Source": "ALTPU"
},
{
"RefID": "BDU:2024-03569",
"RefURL": "https://bdu.fstec.ru/vul/2024-03569",
"Source": "BDU"
},
{
"RefID": "CVE-2024-4317",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-4317",
"Source": "CVE"
}
],
"Description": "This update upgrades postgresql14 to version 14.12-alt0.p10.1. \nSecurity Fix(es):\n\n * BDU:2024-03569: Уязвимость системных представлений pg_stats_ext, pg_stats_ext_exprs СУБД PostgreSQL, позволяющая нарушителю повысить свои привилегии\n\n * CVE-2024-4317: Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from CREATE STATISTICS commands of other users. The most common values may reveal column values the eavesdropper could not otherwise read or results of functions they cannot execute. Installing an unaffected version only fixes fresh PostgreSQL installations, namely those that are created with the initdb utility after installing that version. Current PostgreSQL installations will remain vulnerable until they follow the instructions in the release notes. Within major versions 14-16, minor versions before PostgreSQL 16.3, 15.7, and 14.12 are affected. Versions before PostgreSQL 14 are unaffected.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Low",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2024-05-21"
},
"Updated": {
"Date": "2024-05-21"
},
"BDUs": [
{
"ID": "BDU:2024-03569",
"CVSS": "AV:N/AC:H/Au:S/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"CWE": "CWE-264, CWE-862",
"Href": "https://bdu.fstec.ru/vul/2024-03569",
"Impact": "Low",
"Public": "20240509"
}
],
"CVEs": [
{
"ID": "CVE-2024-4317",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-4317",
"Impact": "None",
"Public": "20240514"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20247930001",
"Comment": "postgresql14 is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930002",
"Comment": "postgresql14-contrib is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930003",
"Comment": "postgresql14-docs is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930004",
"Comment": "postgresql14-llvmjit is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930005",
"Comment": "postgresql14-perl is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930006",
"Comment": "postgresql14-python is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930007",
"Comment": "postgresql14-server is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930008",
"Comment": "postgresql14-server-devel is earlier than 0:14.12-alt0.p10.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247930009",
"Comment": "postgresql14-tcl is earlier than 0:14.12-alt0.p10.1"
}
]
}
]
}
}
]
}

82
oval/c10f1/ALT-PU-2024-7930/objects.json Normal file
View File

@ -0,0 +1,82 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:4001",
"Version": "1",
"Comment": "Evaluate `/etc/os-release` file content",
"Path": {
"Datatype": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RPMInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20247930001",
"Version": "1",
"Comment": "postgresql14 is installed",
"Name": "postgresql14"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930002",
"Version": "1",
"Comment": "postgresql14-contrib is installed",
"Name": "postgresql14-contrib"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930003",
"Version": "1",
"Comment": "postgresql14-docs is installed",
"Name": "postgresql14-docs"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930004",
"Version": "1",
"Comment": "postgresql14-llvmjit is installed",
"Name": "postgresql14-llvmjit"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930005",
"Version": "1",
"Comment": "postgresql14-perl is installed",
"Name": "postgresql14-perl"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930006",
"Version": "1",
"Comment": "postgresql14-python is installed",
"Name": "postgresql14-python"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930007",
"Version": "1",
"Comment": "postgresql14-server is installed",
"Name": "postgresql14-server"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930008",
"Version": "1",
"Comment": "postgresql14-server-devel is installed",
"Name": "postgresql14-server-devel"
},
{
"ID": "oval:org.altlinux.errata:obj:20247930009",
"Version": "1",
"Comment": "postgresql14-tcl is installed",
"Name": "postgresql14-tcl"
}
]
}

23
oval/c10f1/ALT-PU-2024-7930/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:4001",
"Version": "1",
"Text": {}
}
],
"RPMInfoStates": [
{
"ID": "oval:org.altlinux.errata:ste:20247930001",
"Version": "1",
"Comment": "package EVR is earlier than 0:14.12-alt0.p10.1",
"Arch": {},
"EVR": {
"Text": "0:14.12-alt0.p10.1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

126
oval/c10f1/ALT-PU-2024-7930/tests.json Normal file
View File

@ -0,0 +1,126 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:4001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f1' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:4001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:4001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20247930001",
"Version": "1",
"Check": "all",
"Comment": "postgresql14 is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930002",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-contrib is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930003",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-docs is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930004",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-llvmjit is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930004"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930005",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-perl is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930005"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930006",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-python is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930006"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930007",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-server is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930007"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930008",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-server-devel is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930008"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247930009",
"Version": "1",
"Check": "all",
"Comment": "postgresql14-tcl is earlier than 0:14.12-alt0.p10.1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247930009"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247930001"
}
}
]
}

104
oval/c10f2/ALT-PU-2024-7913/definitions.json Normal file
View File

@ -0,0 +1,104 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20247913",
"Version": "oval:org.altlinux.errata:def:20247913",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-7913: package `openstack-glance` update to version 26.0.0-alt0.1.c10f2",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f2"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-7913",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7913",
"Source": "ALTPU"
},
{
"RefID": "BDU:2023-00689",
"RefURL": "https://bdu.fstec.ru/vul/2023-00689",
"Source": "BDU"
},
{
"RefID": "CVE-2022-47951",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-47951",
"Source": "CVE"
}
],
"Description": "This update upgrades openstack-glance to version 26.0.0-alt0.1.c10f2. \nSecurity Fix(es):\n\n * BDU:2023-00689: Уязвимость сервиса блочного хранения данных Openstack Cinder, связанная с использованием файлов и каталогов, доступных внешним сторонам, позволяющая нарушителю раскрыть защищаемую информацию\n\n * CVE-2022-47951: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2024-05-21"
},
"Updated": {
"Date": "2024-05-21"
},
"BDUs": [
{
"ID": "BDU:2023-00689",
"CVSS": "AV:N/AC:H/Au:N/C:C/I:P/A:P",
"CVSS3": "AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L",
"CWE": "CWE-552",
"Href": "https://bdu.fstec.ru/vul/2023-00689",
"Impact": "High",
"Public": "20230124"
}
],
"CVEs": [
{
"ID": "CVE-2022-47951",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N",
"CWE": "CWE-22",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-47951",
"Impact": "Low",
"Public": "20230126"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:5001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20247913001",
"Comment": "openstack-glance is earlier than 1:26.0.0-alt0.1.c10f2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247913002",
"Comment": "python3-module-glance is earlier than 1:26.0.0-alt0.1.c10f2"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20247913003",
"Comment": "python3-module-glance-tests is earlier than 1:26.0.0-alt0.1.c10f2"
}
]
}
]
}
}
]
}

46
oval/c10f2/ALT-PU-2024-7913/objects.json Normal file
View File

@ -0,0 +1,46 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:5001",
"Version": "1",
"Comment": "Evaluate `/etc/os-release` file content",
"Path": {
"Datatype": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RPMInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20247913001",
"Version": "1",
"Comment": "openstack-glance is installed",
"Name": "openstack-glance"
},
{
"ID": "oval:org.altlinux.errata:obj:20247913002",
"Version": "1",
"Comment": "python3-module-glance is installed",
"Name": "python3-module-glance"
},
{
"ID": "oval:org.altlinux.errata:obj:20247913003",
"Version": "1",
"Comment": "python3-module-glance-tests is installed",
"Name": "python3-module-glance-tests"
}
]
}

23
oval/c10f2/ALT-PU-2024-7913/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:5001",
"Version": "1",
"Text": {}
}
],
"RPMInfoStates": [
{
"ID": "oval:org.altlinux.errata:ste:20247913001",
"Version": "1",
"Comment": "package EVR is earlier than 1:26.0.0-alt0.1.c10f2",
"Arch": {},
"EVR": {
"Text": "1:26.0.0-alt0.1.c10f2",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

54
oval/c10f2/ALT-PU-2024-7913/tests.json Normal file
View File

@ -0,0 +1,54 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:5001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c10f2' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:5001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:5001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20247913001",
"Version": "1",
"Check": "all",
"Comment": "openstack-glance is earlier than 1:26.0.0-alt0.1.c10f2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247913001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247913001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247913002",
"Version": "1",
"Check": "all",
"Comment": "python3-module-glance is earlier than 1:26.0.0-alt0.1.c10f2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247913002"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247913001"
}
},
{
"ID": "oval:org.altlinux.errata:tst:20247913003",
"Version": "1",
"Check": "all",
"Comment": "python3-module-glance-tests is earlier than 1:26.0.0-alt0.1.c10f2",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247913003"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247913001"
}
}
]
}

86
oval/c9f2/ALT-PU-2024-7911/definitions.json Normal file
View File

@ -0,0 +1,86 @@
{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20247911",
"Version": "oval:org.altlinux.errata:def:20247911",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2024-7911: package `nip2` update to version 8.7.1-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c9f2"
],
"Products": [
"ALT SPWorkstation",
"ALT SPServer"
]
}
],
"References": [
{
"RefID": "ALT-PU-2024-7911",
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7911",
"Source": "ALTPU"
},
{
"RefID": "CVE-2017-17514",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-17514",
"Source": "CVE"
}
],
"Description": "This update upgrades nip2 to version 8.7.1-alt1. \nSecurity Fix(es):\n\n * CVE-2017-17514: boxes.c in nip2 8.4.0 does not validate strings before launching the program specified by the BROWSER environment variable, which might allow remote attackers to conduct argument-injection attacks via a crafted URL. NOTE: a software maintainer indicates that this product does not use the BROWSER environment variable",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2024-05-21"
},
"Updated": {
"Date": "2024-05-21"
},
"BDUs": null,
"CVEs": [
{
"ID": "CVE-2017-17514",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"CWE": "CWE-74",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-17514",
"Impact": "High",
"Public": "20171214"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:8.4",
"cpe:/o:alt:spserver:8.4"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:3001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20247911001",
"Comment": "nip2 is earlier than 0:8.7.1-alt1"
}
]
}
]
}
}
]
}

34
oval/c9f2/ALT-PU-2024-7911/objects.json Normal file
View File

@ -0,0 +1,34 @@
{
"TextFileContent54Objects": [
{
"ID": "oval:org.altlinux.errata:obj:3001",
"Version": "1",
"Comment": "Evaluate `/etc/os-release` file content",
"Path": {
"Datatype": "string",
"Text": "/etc"
},
"Filepath": {
"Datatype": "string",
"Text": "os-release"
},
"Pattern": {
"Datatype": "string",
"Operation": "pattern match",
"Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d\\.\\d)"
},
"Instance": {
"Datatype": "int",
"Text": "1"
}
}
],
"RPMInfoObjects": [
{
"ID": "oval:org.altlinux.errata:obj:20247911001",
"Version": "1",
"Comment": "nip2 is installed",
"Name": "nip2"
}
]
}

23
oval/c9f2/ALT-PU-2024-7911/states.json Normal file
View File

@ -0,0 +1,23 @@
{
"TextFileContent54State": [
{
"ID": "oval:org.altlinux.errata:ste:3001",
"Version": "1",
"Text": {}
}
],
"RPMInfoStates": [
{
"ID": "oval:org.altlinux.errata:ste:20247911001",
"Version": "1",
"Comment": "package EVR is earlier than 0:8.7.1-alt1",
"Arch": {},
"EVR": {
"Text": "0:8.7.1-alt1",
"Datatype": "evr_string",
"Operation": "less than"
},
"Subexpression": {}
}
]
}

30
oval/c9f2/ALT-PU-2024-7911/tests.json Normal file
View File

@ -0,0 +1,30 @@
{
"TextFileContent54Tests": [
{
"ID": "oval:org.altlinux.errata:tst:3001",
"Version": "1",
"Check": "all",
"Comment": "ALT Linux based on branch 'c9f2' must be installed",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:3001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:3001"
}
}
],
"RPMInfoTests": [
{
"ID": "oval:org.altlinux.errata:tst:20247911001",
"Version": "1",
"Check": "all",
"Comment": "nip2 is earlier than 0:8.7.1-alt1",
"Object": {
"ObjectRef": "oval:org.altlinux.errata:obj:20247911001"
},
"State": {
"StateRef": "oval:org.altlinux.errata:ste:20247911001"
}
}
]
}