273 lines
13 KiB
JSON
273 lines
13 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20202926",
|
||
"Version": "oval:org.altlinux.errata:def:20202926",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2020-2926: package `node` update to version 14.11.0-alt2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p9"
|
||
],
|
||
"Products": [
|
||
"ALT Server",
|
||
"ALT Virtualization Server",
|
||
"ALT Workstation",
|
||
"ALT Workstation K",
|
||
"ALT Education",
|
||
"Simply Linux",
|
||
"Starterkit"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2020-2926",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-2926",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-03621",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-03621",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-04460",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-04460",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-04461",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-04461",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-05054",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-05054",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-05657",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-05657",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-05687",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-05687",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-11080",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-11080",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8172",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8172",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8174",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8174",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8201",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8251",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8251",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8252",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades node to version 14.11.0-alt2. \nSecurity Fix(es):\n\n * BDU:2020-03621: Уязвимость реализации протокола TLS программной платформы Node.js, позволяющая нарушителю реализовать атаку типа «человек посередине»\n\n * BDU:2020-04460: Уязвимость функций napi_get_value_string_latin1(), napi_get_value_string_utf8(), napi_get_value_string_utf16() программной платформы Node.js, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2020-04461: Уязвимость библиотеки nghttp2, связанная с ошибками при использовании выделенной памяти при обработке пакетов HTTP/2 SETTINGS, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-05054: Уязвимость компонента Cluster: JS module (Node.js) системы управления базами данных Oracle MySQL Cluster, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2020-05657: Уязвимость программной платформы Node.js, связанная с ошибкой обработки имен HTTP - заголовка, позволяющая нарушителю получить доступ к защищаемой информации или повысить свои привилегии\n\n * BDU:2020-05687: Уязвимость программной платформы Node.js, связанная с ошибкой обработки имен HTTP - заголовка, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2020-11080: In nghttp2 before version 1.41.0, the overly large HTTP/2 SETTINGS frame payload causes denial of service. The proof of concept attack involves a malicious client constructing a SETTINGS frame with a length of 14,400 bytes (2400 individual settings entries) over and over again. The attack causes the CPU to spike at 100%. nghttp2 v1.41.0 fixes this vulnerability. There is a workaround to this vulnerability. Implement nghttp2_on_frame_recv_callback callback, and if received frame is SETTINGS frame and the number of settings entries are large (e.g., \u003e 32), then drop the connection.\n\n * CVE-2020-8172: TLS session reuse can lead to host certificate verification bypass in node version \u003c 12.18.0 and \u003c 14.4.0.\n\n * CVE-2020-8174: napi_get_value_string_*() allows various kinds of memory corruption in node \u003c 10.21.0, 12.18.0, and \u003c 14.4.0.\n\n * CVE-2020-8201: Node.js \u003c 12.18.4 and \u003c 14.11 can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system. The attack was possible due to a bug in processing of carrier-return symbols in the HTTP header names.\n\n * CVE-2020-8251: Node.js \u003c 14.11.0 is vulnerable to HTTP denial of service (DoS) attacks based on delayed requests submission which can make the server unable to accept new connections.\n\n * CVE-2020-8252: The implementation of realpath in libuv \u003c 10.22.1, \u003c 12.18.4, and \u003c 14.9.0 used within Node.js incorrectly determined the buffer size which can result in a buffer overflow if the resolved path is longer than 256 bytes.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2020-10-02"
|
||
},
|
||
"Updated": {
|
||
"Date": "2020-10-02"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2020-03621",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-285, CWE-295",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-03621",
|
||
"Impact": "High",
|
||
"Public": "20200305"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-04460",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-04460",
|
||
"Impact": "High",
|
||
"Public": "20200724"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-04461",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-707",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-04461",
|
||
"Impact": "High",
|
||
"Public": "20200603"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-05054",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-05054",
|
||
"Impact": "High",
|
||
"Public": "20200724"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-05657",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-444",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-05657",
|
||
"Impact": "High",
|
||
"Public": "20200918"
|
||
},
|
||
{
|
||
"ID": "BDU:2020-05687",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-400",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-05687",
|
||
"Impact": "High",
|
||
"Public": "20200918"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2020-11080",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-707",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-11080",
|
||
"Impact": "High",
|
||
"Public": "20200603"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8172",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8172",
|
||
"Impact": "High",
|
||
"Public": "20200608"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8174",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-191",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8174",
|
||
"Impact": "High",
|
||
"Public": "20200724"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8201",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-444",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8201",
|
||
"Impact": "High",
|
||
"Public": "20200918"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8251",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-400",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8251",
|
||
"Impact": "High",
|
||
"Public": "20200918"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8252",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-120",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8252",
|
||
"Impact": "High",
|
||
"Public": "20200918"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:kworkstation:9",
|
||
"cpe:/o:alt:workstation:9",
|
||
"cpe:/o:alt:server:9",
|
||
"cpe:/o:alt:server-v:9",
|
||
"cpe:/o:alt:education:9",
|
||
"cpe:/o:alt:slinux:9",
|
||
"cpe:/o:alt:starterkit:p9",
|
||
"cpe:/o:alt:kworkstation:9.1",
|
||
"cpe:/o:alt:workstation:9.1",
|
||
"cpe:/o:alt:server:9.1",
|
||
"cpe:/o:alt:server-v:9.1",
|
||
"cpe:/o:alt:education:9.1",
|
||
"cpe:/o:alt:slinux:9.1",
|
||
"cpe:/o:alt:starterkit:9.1",
|
||
"cpe:/o:alt:kworkstation:9.2",
|
||
"cpe:/o:alt:workstation:9.2",
|
||
"cpe:/o:alt:server:9.2",
|
||
"cpe:/o:alt:server-v:9.2",
|
||
"cpe:/o:alt:education:9.2",
|
||
"cpe:/o:alt:slinux:9.2",
|
||
"cpe:/o:alt:starterkit:9.2"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:1001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20202926001",
|
||
"Comment": "node is earlier than 0:14.11.0-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20202926002",
|
||
"Comment": "node-devel is earlier than 0:14.11.0-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20202926003",
|
||
"Comment": "node-doc is earlier than 0:14.11.0-alt2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |