149 lines
6.1 KiB
JSON
149 lines
6.1 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20182148",
|
||
"Version": "oval:org.altlinux.errata:def:20182148",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2018-2148: package `389-ds-base` update to version 1.3.8.5-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2018-2148",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2018-2148",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2020-02901",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2020-02901",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2017-15134",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-15134",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-10871",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-10871",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-14638",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-14638",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades 389-ds-base to version 1.3.8.5-alt1. \nSecurity Fix(es):\n\n * BDU:2020-02901: Уязвимость службы каталогов уровня предприятия 389 Directory Server, связанная с выходом операции за границы буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2017-15134: A stack buffer overflow flaw was found in the way 389-ds-base 1.3.6.x before 1.3.6.13, 1.3.7.x before 1.3.7.9, 1.4.x before 1.4.0.5 handled certain LDAP search filters. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.\n\n * CVE-2018-10871: 389-ds-base before versions 1.3.8.5, 1.4.0.12 is vulnerable to a Cleartext Storage of Sensitive Information. By default, when the Replica and/or retroChangeLog plugins are enabled, 389-ds-base stores passwords in plaintext format in their respective changelog files. An attacker with sufficiently high privileges, such as root or Directory Manager, can query these files in order to retrieve plaintext passwords.\n\n * CVE-2018-14638: A flaw was found in 389-ds-base before version 1.3.8.4-13. The process ns-slapd crashes in delete_passwdPolicy function when persistent search connections are terminated unexpectedly leading to remote denial of service.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2018-08-15"
|
||
},
|
||
"Updated": {
|
||
"Date": "2018-08-15"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2020-02901",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://bdu.fstec.ru/vul/2020-02901",
|
||
"Impact": "High",
|
||
"Public": "20180301"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2017-15134",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-119",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-15134",
|
||
"Impact": "High",
|
||
"Public": "20180301"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-10871",
|
||
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-312",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-10871",
|
||
"Impact": "High",
|
||
"Public": "20180718"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-14638",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-415",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-14638",
|
||
"Impact": "High",
|
||
"Public": "20180914"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:5001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20182148001",
|
||
"Comment": "389-ds is earlier than 0:1.3.8.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20182148002",
|
||
"Comment": "389-ds-base is earlier than 0:1.3.8.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20182148003",
|
||
"Comment": "389-ds-base-devel is earlier than 0:1.3.8.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20182148004",
|
||
"Comment": "389-ds-base-libs is earlier than 0:1.3.8.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20182148005",
|
||
"Comment": "python3-module-389-ds-tests is earlier than 0:1.3.8.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20182148006",
|
||
"Comment": "python3-module-lib389 is earlier than 0:1.3.8.5-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |