ALT Vulnerability

oval/c10f1/ALT-PU-2024-13743/definitions.json

@@ -0,0 +1,101 @@
+{
+  "Definition": [
+    {
+      "ID": "oval:org.altlinux.errata:def:202413743",
+      "Version": "oval:org.altlinux.errata:def:202413743",
+      "Class": "patch",
+      "Metadata": {
+        "Title": "ALT-PU-2024-13743: package `pgbouncer` update to version 1.23.0-alt1.1",
+        "AffectedList": [
+          {
+            "Family": "unix",
+            "Platforms": [
+              "ALT Linux branch c10f1"
+            ],
+            "Products": [
+              "ALT SP Workstation",
+              "ALT SP Server"
+            ]
+          }
+        ],
+        "References": [
+          {
+            "RefID": "ALT-PU-2024-13743",
+            "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13743",
+            "Source": "ALTPU"
+          },
+          {
+            "RefID": "BDU:2022-00342",
+            "RefURL": "https://bdu.fstec.ru/vul/2022-00342",
+            "Source": "BDU"
+          },
+          {
+            "RefID": "CVE-2021-3672",
+            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3672",
+            "Source": "CVE"
+          }
+        ],
+        "Description": "This update upgrades pgbouncer to version 1.23.0-alt1.1. \nSecurity Fix(es):\n\n * BDU:2022-00342: Уязвимость библиотеки СИ для асинхронных запросов DNS c-ares, связанная с непринятием мер по защите структуры веб-страницы, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * CVE-2021-3672: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong hostnames which might potentially lead to Domain Hijacking. The highest threat from this vulnerability is to confidentiality and integrity as well as system availability.",
+        "Advisory": {
+          "From": "errata.altlinux.org",
+          "Severity": "Low",
+          "Rights": "Copyright 2024 BaseALT Ltd.",
+          "Issued": {
+            "Date": "2024-10-10"
+          },
+          "Updated": {
+            "Date": "2024-10-10"
+          },
+          "BDUs": [
+            {
+              "ID": "BDU:2022-00342",
+              "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
+              "CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+              "CWE": "CWE-79",
+              "Href": "https://bdu.fstec.ru/vul/2022-00342",
+              "Impact": "Low",
+              "Public": "20210810"
+            }
+          ],
+          "CVEs": [
+            {
+              "ID": "CVE-2021-3672",
+              "CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
+              "CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
+              "CWE": "CWE-79",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3672",
+              "Impact": "Low",
+              "Public": "20211123"
+            }
+          ],
+          "AffectedCPEs": {
+            "CPEs": [
+              "cpe:/o:alt:spworkstation:10",
+              "cpe:/o:alt:spserver:10"
+            ]
+          }
+        }
+      },
+      "Criteria": {
+        "Operator": "AND",
+        "Criterions": [
+          {
+            "TestRef": "oval:org.altlinux.errata:tst:4001",
+            "Comment": "ALT Linux must be installed"
+          }
+        ],
+        "Criterias": [
+          {
+            "Operator": "OR",
+            "Criterions": [
+              {
+                "TestRef": "oval:org.altlinux.errata:tst:202413743001",
+                "Comment": "pgbouncer is earlier than 0:1.23.0-alt1.1"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}

oval/c10f1/ALT-PU-2024-13743/objects.json

@@ -0,0 +1,34 @@
+{
+  "TextFileContent54Objects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:4001",
+      "Version": "1",
+      "Comment": "Evaluate `/etc/os-release` file content",
+      "Path": {
+        "Datatype": "string",
+        "Text": "/etc"
+      },
+      "Filepath": {
+        "Datatype": "string",
+        "Text": "os-release"
+      },
+      "Pattern": {
+        "Datatype": "string",
+        "Operation": "pattern match",
+        "Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d+)"
+      },
+      "Instance": {
+        "Datatype": "int",
+        "Text": "1"
+      }
+    }
+  ],
+  "RPMInfoObjects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:202413743001",
+      "Version": "1",
+      "Comment": "pgbouncer is installed",
+      "Name": "pgbouncer"
+    }
+  ]
+}

oval/c10f1/ALT-PU-2024-13743/states.json

@@ -0,0 +1,23 @@
+{
+  "TextFileContent54State": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:4001",
+      "Version": "1",
+      "Text": {}
+    }
+  ],
+  "RPMInfoStates": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:202413743001",
+      "Version": "1",
+      "Comment": "package EVR is earlier than 0:1.23.0-alt1.1",
+      "Arch": {},
+      "EVR": {
+        "Text": "0:1.23.0-alt1.1",
+        "Datatype": "evr_string",
+        "Operation": "less than"
+      },
+      "Subexpression": {}
+    }
+  ]
+}

oval/c10f1/ALT-PU-2024-13743/tests.json

@@ -0,0 +1,30 @@
+{
+  "TextFileContent54Tests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:4001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "ALT Linux based on branch 'c10f1' must be installed",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:4001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:4001"
+      }
+    }
+  ],
+  "RPMInfoTests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:202413743001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "pgbouncer is earlier than 0:1.23.0-alt1.1",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:202413743001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:202413743001"
+      }
+    }
+  ]
+}

oval/c9f2/ALT-PU-2024-13675/definitions.json

@@ -0,0 +1,157 @@
+{
+  "Definition": [
+    {
+      "ID": "oval:org.altlinux.errata:def:202413675",
+      "Version": "oval:org.altlinux.errata:def:202413675",
+      "Class": "patch",
+      "Metadata": {
+        "Title": "ALT-PU-2024-13675: package `unzip` update to version 6.0-alt6",
+        "AffectedList": [
+          {
+            "Family": "unix",
+            "Platforms": [
+              "ALT Linux branch c9f2"
+            ],
+            "Products": [
+              "ALT SPWorkstation",
+              "ALT SPServer"
+            ]
+          }
+        ],
+        "References": [
+          {
+            "RefID": "ALT-PU-2024-13675",
+            "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13675",
+            "Source": "ALTPU"
+          },
+          {
+            "RefID": "BDU:2020-01692",
+            "RefURL": "https://bdu.fstec.ru/vul/2020-01692",
+            "Source": "BDU"
+          },
+          {
+            "RefID": "BDU:2023-00293",
+            "RefURL": "https://bdu.fstec.ru/vul/2023-00293",
+            "Source": "BDU"
+          },
+          {
+            "RefID": "BDU:2023-00295",
+            "RefURL": "https://bdu.fstec.ru/vul/2023-00295",
+            "Source": "BDU"
+          },
+          {
+            "RefID": "CVE-2019-13232",
+            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-13232",
+            "Source": "CVE"
+          },
+          {
+            "RefID": "CVE-2022-0529",
+            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-0529",
+            "Source": "CVE"
+          },
+          {
+            "RefID": "CVE-2022-0530",
+            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-0530",
+            "Source": "CVE"
+          }
+        ],
+        "Description": "This update upgrades unzip to version 6.0-alt6. \nSecurity Fix(es):\n\n * BDU:2020-01692: Уязвимость файлового архиватора Info-ZIP Unzip, связанная с неконтролируемым расходом ресурса, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2023-00293: Уязвимость файлового архиватора UnZip, связанная с записью за границами буфера, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2023-00295: Уязвимость файлового архиватора UnZip, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2019-13232: Info-ZIP UnZip 6.0 mishandles the overlapping of files inside a ZIP container, leading to denial of service (resource consumption), aka a \"better zip bomb\" issue.\n\n * CVE-2022-0529: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.\n\n * CVE-2022-0530: A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.",
+        "Advisory": {
+          "From": "errata.altlinux.org",
+          "Severity": "High",
+          "Rights": "Copyright 2024 BaseALT Ltd.",
+          "Issued": {
+            "Date": "2024-10-10"
+          },
+          "Updated": {
+            "Date": "2024-10-10"
+          },
+          "BDUs": [
+            {
+              "ID": "BDU:2020-01692",
+              "CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
+              "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-400",
+              "Href": "https://bdu.fstec.ru/vul/2020-01692",
+              "Impact": "High",
+              "Public": "20190704"
+            },
+            {
+              "ID": "BDU:2023-00293",
+              "CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
+              "CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-787",
+              "Href": "https://bdu.fstec.ru/vul/2023-00293",
+              "Impact": "Low",
+              "Public": "20220207"
+            },
+            {
+              "ID": "BDU:2023-00295",
+              "CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
+              "CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-119",
+              "Href": "https://bdu.fstec.ru/vul/2023-00295",
+              "Impact": "Low",
+              "Public": "20220228"
+            }
+          ],
+          "CVEs": [
+            {
+              "ID": "CVE-2019-13232",
+              "CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
+              "CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
+              "CWE": "CWE-400",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-13232",
+              "Impact": "Low",
+              "Public": "20190704"
+            },
+            {
+              "ID": "CVE-2022-0529",
+              "CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
+              "CVSS3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+              "CWE": "CWE-787",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-0529",
+              "Impact": "Low",
+              "Public": "20220209"
+            },
+            {
+              "ID": "CVE-2022-0530",
+              "CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
+              "CVSS3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
+              "CWE": "NVD-CWE-Other",
+              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-0530",
+              "Impact": "Low",
+              "Public": "20220209"
+            }
+          ],
+          "AffectedCPEs": {
+            "CPEs": [
+              "cpe:/o:alt:spworkstation:8.4",
+              "cpe:/o:alt:spserver:8.4"
+            ]
+          }
+        }
+      },
+      "Criteria": {
+        "Operator": "AND",
+        "Criterions": [
+          {
+            "TestRef": "oval:org.altlinux.errata:tst:3001",
+            "Comment": "ALT Linux must be installed"
+          }
+        ],
+        "Criterias": [
+          {
+            "Operator": "OR",
+            "Criterions": [
+              {
+                "TestRef": "oval:org.altlinux.errata:tst:202413675001",
+                "Comment": "unzip is earlier than 0:6.0-alt6"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}

oval/c9f2/ALT-PU-2024-13675/objects.json

@@ -0,0 +1,34 @@
+{
+  "TextFileContent54Objects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:3001",
+      "Version": "1",
+      "Comment": "Evaluate `/etc/os-release` file content",
+      "Path": {
+        "Datatype": "string",
+        "Text": "/etc"
+      },
+      "Filepath": {
+        "Datatype": "string",
+        "Text": "os-release"
+      },
+      "Pattern": {
+        "Datatype": "string",
+        "Operation": "pattern match",
+        "Text": "cpe:\\/o:alt:sp(?:server|workstation):(\\d\\.\\d)"
+      },
+      "Instance": {
+        "Datatype": "int",
+        "Text": "1"
+      }
+    }
+  ],
+  "RPMInfoObjects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:202413675001",
+      "Version": "1",
+      "Comment": "unzip is installed",
+      "Name": "unzip"
+    }
+  ]
+}

oval/c9f2/ALT-PU-2024-13675/states.json

@@ -0,0 +1,23 @@
+{
+  "TextFileContent54State": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:3001",
+      "Version": "1",
+      "Text": {}
+    }
+  ],
+  "RPMInfoStates": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:202413675001",
+      "Version": "1",
+      "Comment": "package EVR is earlier than 0:6.0-alt6",
+      "Arch": {},
+      "EVR": {
+        "Text": "0:6.0-alt6",
+        "Datatype": "evr_string",
+        "Operation": "less than"
+      },
+      "Subexpression": {}
+    }
+  ]
+}

oval/c9f2/ALT-PU-2024-13675/tests.json

@@ -0,0 +1,30 @@
+{
+  "TextFileContent54Tests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:3001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "ALT Linux based on branch 'c9f2' must be installed",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:3001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:3001"
+      }
+    }
+  ],
+  "RPMInfoTests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:202413675001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "unzip is earlier than 0:6.0-alt6",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:202413675001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:202413675001"
+      }
+    }
+  ]
+}

oval/p10/ALT-PU-2024-13683/definitions.json

@@ -0,0 +1,101 @@
+{
+  "Definition": [
+    {
+      "ID": "oval:org.altlinux.errata:def:202413683",
+      "Version": "oval:org.altlinux.errata:def:202413683",
+      "Class": "patch",
+      "Metadata": {
+        "Title": "ALT-PU-2024-13683: package `installer-alterator-pkg` update to version 3.1.8-alt1",
+        "AffectedList": [
+          {
+            "Family": "unix",
+            "Platforms": [
+              "ALT Linux branch p10"
+            ],
+            "Products": [
+              "ALT Server",
+              "ALT Virtualization Server",
+              "ALT Workstation",
+              "ALT Workstation K",
+              "ALT Education",
+              "Simply Linux",
+              "Starterkit"
+            ]
+          }
+        ],
+        "References": [
+          {
+            "RefID": "ALT-PU-2024-13683",
+            "RefURL": "https://errata.altlinux.org/ALT-PU-2024-13683",
+            "Source": "ALTPU"
+          }
+        ],
+        "Description": "This update upgrades installer-alterator-pkg to version 3.1.8-alt1. \nSecurity Fix(es):\n\n * #45939: Можно ввести посторонний текст в поле групп приложений",
+        "Advisory": {
+          "From": "errata.altlinux.org",
+          "Severity": "Low",
+          "Rights": "Copyright 2024 BaseALT Ltd.",
+          "Issued": {
+            "Date": "2024-10-10"
+          },
+          "Updated": {
+            "Date": "2024-10-10"
+          },
+          "BDUs": null,
+          "Bugzilla": [
+            {
+              "ID": "45939",
+              "Href": "https://bugzilla.altlinux.org/45939",
+              "Data": "Можно ввести посторонний текст в поле групп приложений"
+            }
+          ],
+          "AffectedCPEs": {
+            "CPEs": [
+              "cpe:/o:alt:kworkstation:10",
+              "cpe:/o:alt:workstation:10",
+              "cpe:/o:alt:server:10",
+              "cpe:/o:alt:server-v:10",
+              "cpe:/o:alt:education:10",
+              "cpe:/o:alt:slinux:10",
+              "cpe:/o:alt:starterkit:p10",
+              "cpe:/o:alt:kworkstation:10.1",
+              "cpe:/o:alt:workstation:10.1",
+              "cpe:/o:alt:server:10.1",
+              "cpe:/o:alt:server-v:10.1",
+              "cpe:/o:alt:education:10.1",
+              "cpe:/o:alt:slinux:10.1",
+              "cpe:/o:alt:starterkit:10.1",
+              "cpe:/o:alt:kworkstation:10.2",
+              "cpe:/o:alt:workstation:10.2",
+              "cpe:/o:alt:server:10.2",
+              "cpe:/o:alt:server-v:10.2",
+              "cpe:/o:alt:education:10.2",
+              "cpe:/o:alt:slinux:10.2",
+              "cpe:/o:alt:starterkit:10.2"
+            ]
+          }
+        }
+      },
+      "Criteria": {
+        "Operator": "AND",
+        "Criterions": [
+          {
+            "TestRef": "oval:org.altlinux.errata:tst:2001",
+            "Comment": "ALT Linux must be installed"
+          }
+        ],
+        "Criterias": [
+          {
+            "Operator": "OR",
+            "Criterions": [
+              {
+                "TestRef": "oval:org.altlinux.errata:tst:202413683001",
+                "Comment": "installer-alterator-pkg is earlier than 0:3.1.8-alt1"
+              }
+            ]
+          }
+        ]
+      }
+    }
+  ]
+}

oval/p10/ALT-PU-2024-13683/objects.json

@@ -0,0 +1,34 @@
+{
+  "TextFileContent54Objects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:2001",
+      "Version": "1",
+      "Comment": "Evaluate `/etc/os-release` file content",
+      "Path": {
+        "Datatype": "string",
+        "Text": "/etc"
+      },
+      "Filepath": {
+        "Datatype": "string",
+        "Text": "os-release"
+      },
+      "Pattern": {
+        "Datatype": "string",
+        "Operation": "pattern match",
+        "Text": "cpe:\\/o:alt:(?!sp)[a-z\\-]+:p?(\\d+)(?:\\.\\d)*"
+      },
+      "Instance": {
+        "Datatype": "int",
+        "Text": "1"
+      }
+    }
+  ],
+  "RPMInfoObjects": [
+    {
+      "ID": "oval:org.altlinux.errata:obj:202413683001",
+      "Version": "1",
+      "Comment": "installer-alterator-pkg is installed",
+      "Name": "installer-alterator-pkg"
+    }
+  ]
+}

oval/p10/ALT-PU-2024-13683/states.json

@@ -0,0 +1,23 @@
+{
+  "TextFileContent54State": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:2001",
+      "Version": "1",
+      "Text": {}
+    }
+  ],
+  "RPMInfoStates": [
+    {
+      "ID": "oval:org.altlinux.errata:ste:202413683001",
+      "Version": "1",
+      "Comment": "package EVR is earlier than 0:3.1.8-alt1",
+      "Arch": {},
+      "EVR": {
+        "Text": "0:3.1.8-alt1",
+        "Datatype": "evr_string",
+        "Operation": "less than"
+      },
+      "Subexpression": {}
+    }
+  ]
+}

oval/p10/ALT-PU-2024-13683/tests.json

@@ -0,0 +1,30 @@
+{
+  "TextFileContent54Tests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:2001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "ALT Linux based on branch 'p10' must be installed",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:2001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:2001"
+      }
+    }
+  ],
+  "RPMInfoTests": [
+    {
+      "ID": "oval:org.altlinux.errata:tst:202413683001",
+      "Version": "1",
+      "Check": "all",
+      "Comment": "installer-alterator-pkg is earlier than 0:3.1.8-alt1",
+      "Object": {
+        "ObjectRef": "oval:org.altlinux.errata:obj:202413683001"
+      },
+      "State": {
+        "StateRef": "oval:org.altlinux.errata:ste:202413683001"
+      }
+    }
+  ]
+}