255 lines
21 KiB
JSON
255 lines
21 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:202417181",
|
||
"Version": "oval:org.altlinux.errata:def:202417181",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2024-17181: package `openssl1.1` update to version 1.1.1w-alt0.p10.2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2024-17181",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-17181",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-08615",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-08615",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-01337",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-01337",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-04109",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-04109",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-05176",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-05176",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-06988",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-06988",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-08755",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-08755",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-5678",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-0727",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-2511",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-2511",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-4741",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-4741",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-5535",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-5535",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-9143",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-9143",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades openssl1.1 to version 1.1.1w-alt0.p10.2. \nSecurity Fix(es):\n\n * BDU:2023-08615: Уязвимость функции DH_generate_key() библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2024-01337: Уязвимость функций PKCS12_parse(), PKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes() и PKCS12_newpass() библиотеки OpenSSL, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2024-04109: Уязвимость криптографической библиотеки OpenSSL, связанная с ошибками освобождения ресурсов, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2024-05176: Уязвимость функции SSL_free_buffers() криптографической библиотеки OpenSSL, позволяющая нарушителю выполнить произвольный код или вызвать отказ в обслуживании\n\n * BDU:2024-06988: Уязвимость функции SSL_select_next_proto инструментария для протоколов TLS и SSL OpenSSL, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным, а также вызвать отказ в обслуживании\n\n * BDU:2024-08755: Уязвимость функций EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(), BN_GF2m_*() интерфейса Elliptic Curve API криптографической библиотеки OpenSSL, позволяющая нарушителю выполнить произвольный код\n\n * CVE-2023-5678: Issue summary: Generating excessively long X9.42 DH keys or checking\nexcessively long X9.42 DH keys or parameters may be very slow.\n\nImpact summary: Applications that use the functions DH_generate_key() to\ngenerate an X9.42 DH key may experience long delays. Likewise, applications\nthat use DH_check_pub_key(), DH_check_pub_key_ex() or EVP_PKEY_public_check()\nto check an X9.42 DH key or X9.42 DH parameters may experience long delays.\nWhere the key or parameters that are being checked have been obtained from\nan untrusted source this may lead to a Denial of Service.\n\nWhile DH_check() performs all the necessary checks (as of CVE-2023-3817),\nDH_check_pub_key() doesn't make any of these checks, and is therefore\nvulnerable for excessively large P and Q parameters.\n\nLikewise, while DH_generate_key() performs a check for an excessively large\nP, it doesn't check for an excessively large Q.\n\nAn application that calls DH_generate_key() or DH_check_pub_key() and\nsupplies a key or parameters obtained from an untrusted source could be\nvulnerable to a Denial of Service attack.\n\nDH_generate_key() and DH_check_pub_key() are also called by a number of\nother OpenSSL functions. An application calling any of those other\nfunctions may similarly be affected. The other functions affected by this\nare DH_check_pub_key_ex(), EVP_PKEY_public_check(), and EVP_PKEY_generate().\n\nAlso vulnerable are the OpenSSL pkey command line application when using the\n\"-pubcheck\" option, as well as the OpenSSL genpkey command line application.\n\nThe OpenSSL SSL/TLS implementation is not affected by this issue.\n\nThe OpenSSL 3.0 and 3.1 FIPS providers are not affected by this issue.\n\n * CVE-2024-0727: Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL\nto crash leading to a potential Denial of Service attack\n\nImpact summary: Applications loading files in the PKCS12 format from untrusted\nsources might terminate abruptly.\n\nA file in PKCS12 format can contain certificates and keys and may come from an\nuntrusted source. The PKCS12 specification allows certain fields to be NULL, but\nOpenSSL does not correctly check for this case. This can lead to a NULL pointer\ndereference that results in OpenSSL crashing. If an application processes PKCS12\nfiles from an untrusted source using the OpenSSL APIs then that application will\nbe vulnerable to this issue.\n\nOpenSSL APIs that are vulnerable to this are: PKCS12_parse(),\nPKCS12_unpack_p7data(), PKCS12_unpack_p7encdata(), PKCS12_unpack_authsafes()\nand PKCS12_newpass().\n\nWe have also fixed a similar issue in SMIME_write_PKCS7(). However since this\nfunction is related to writing data we do not consider it security significant.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue.\n\n * CVE-2024-2511: Issue summary: Some non-default TLS server configurations can cause unbounded\nmemory growth when processing TLSv1.3 sessions\n\nImpact summary: An attacker may exploit certain server configurations to trigger\nunbounded memory growth that would lead to a Denial of Service\n\nThis problem can occur in TLSv1.3 if the non-default SSL_OP_NO_TICKET option is\nbeing used (but not if early_data support is also configured and the default\nanti-replay protection is in use). In this case, under certain conditions, the\nsession cache can get into an incorrect state and it will fail to flush properly\nas it fills. The session cache will continue to grow in an unbounded manner. A\nmalicious client could deliberately create the scenario for this failure to\nforce a Denial of Service. It may also happen by accident in normal operation.\n\nThis issue only affects TLS servers supporting TLSv1.3. It does not affect TLS\nclients.\n\nThe FIPS modules in 3.2, 3.1 and 3.0 are not affected by this issue. OpenSSL\n1.0.2 is also not affected by this issue.\n\n * CVE-2024-4741: Issue summary: Calling the OpenSSL API function SSL_free_buffers may cause\nmemory to be accessed that was previously freed in some situations\n\nImpact summary: A use after free can have a range of potential consequences such\nas the corruption of valid data, crashes or execution of arbitrary code.\nHowever, only applications that directly call the SSL_free_buffers function are\naffected by this issue. Applications that do not call this function are not\nvulnerable. Our investigations indicate that this function is rarely used by\napplications.\n\nThe SSL_free_buffers function is used to free the internal OpenSSL buffer used\nwhen processing an incoming record from the network. The call is only expected\nto succeed if the buffer is not currently in use. However, two scenarios have\nbeen identified where the buffer is freed even when still in use.\n\nThe first scenario occurs where a record header has been received from the\nnetwork and processed by OpenSSL, but the full record body has not yet arrived.\nIn this case calling SSL_free_buffers will succeed even though a record has only\nbeen partially processed and the buffer is still in use.\n\nThe second scenario occurs where a full record containing application data has\nbeen received and processed by OpenSSL but the application has only read part of\nthis data. Again a call to SSL_free_buffers will succeed even though the buffer\nis still in use.\n\nWhile these scenarios could occur accidentally during normal operation a\nmalicious attacker could attempt to engineer a stituation where this occurs.\nWe are not aware of this issue being actively exploited.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\n * CVE-2024-5535: Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an\nempty supported client protocols buffer may cause a crash or memory contents to\nbe sent to the peer.\n\nImpact summary: A buffer overread can have a range of potential consequences\nsuch as unexpected application beahviour or a crash. In particular this issue\ncould result in up to 255 bytes of arbitrary private data from memory being sent\nto the peer leading to a loss of confidentiality. However, only applications\nthat directly call the SSL_select_next_proto function with a 0 length list of\nsupported client protocols are affected by this issue. This would normally never\nbe a valid scenario and is typically not under attacker control but may occur by\naccident in the case of a configuration or programming error in the calling\napplication.\n\nThe OpenSSL API function SSL_select_next_proto is typically used by TLS\napplications that support ALPN (Application Layer Protocol Negotiation) or NPN\n(Next Protocol Negotiation). NPN is older, was never standardised and\nis deprecated in favour of ALPN. We believe that ALPN is significantly more\nwidely deployed than NPN. The SSL_select_next_proto function accepts a list of\nprotocols from the server and a list of protocols from the client and returns\nthe first protocol that appears in the server list that also appears in the\nclient list. In the case of no overlap between the two lists it returns the\nfirst item in the client list. In either case it will signal whether an overlap\nbetween the two lists was found. In the case where SSL_select_next_proto is\ncalled with a zero length client list it fails to notice this condition and\nreturns the memory immediately following the client list pointer (and reports\nthat there was no overlap in the lists).\n\nThis function is typically called from a server side application callback for\nALPN or a client side application callback for NPN. In the case of ALPN the list\nof protocols supplied by the client is guaranteed by libssl to never be zero in\nlength. The list of server protocols comes from the application and should never\nnormally be expected to be of zero length. In this case if the\nSSL_select_next_proto function has been called as expected (with the list\nsupplied by the client passed in the client/client_len parameters), then the\napplication will not be vulnerable to this issue. If the application has\naccidentally been configured with a zero length server list, and has\naccidentally passed that zero length server list in the client/client_len\nparameters, and has additionally failed to correctly handle a \"no overlap\"\nresponse (which would normally result in a handshake failure in ALPN) then it\nwill be vulnerable to this problem.\n\nIn the case of NPN, the protocol permits the client to opportunistically select\na protocol when there is no overlap. OpenSSL returns the first client protocol\nin the no overlap case in support of this. The list of client protocols comes\nfrom the application and should never normally be expected to be of zero length.\nHowever if the SSL_select_next_proto function is accidentally called with a\nclient_len of 0 then an invalid memory pointer will be returned instead. If the\napplication uses this output as the opportunistic protocol then the loss of\nconfidentiality will occur.\n\nThis issue has been assessed as Low severity because applications are most\nlikely to be vulnerable if they are using NPN instead of ALPN - but NPN is not\nwidely used. It also requires an application configuration or programming error.\nFinally, this issue would not typically be under attacker control making active\nexploitation unlikely.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.\n\nDue to the low severity of this issue we are not issuing new releases of\nOpenSSL at this time. The fix will be included in the next releases when they\nbecome available.\n\n * CVE-2024-9143: Issue summary: Use of the low-level GF(2^m) elliptic curve APIs with untrusted\nexplicit values for the field polynomial can lead to out-of-bounds memory reads\nor writes.\n\nImpact summary: Out of bound memory writes can lead to an application crash or\neven a possibility of a remote code execution, however, in all the protocols\ninvolving Elliptic Curve Cryptography that we're aware of, either only \"named\ncurves\" are supported, or, if explicit curve parameters are supported, they\nspecify an X9.62 encoding of binary (GF(2^m)) curves that can't represent\nproblematic input values. Thus the likelihood of existence of a vulnerable\napplication is low.\n\nIn particular, the X9.62 encoding is used for ECC keys in X.509 certificates,\nso problematic inputs cannot occur in the context of processing X.509\ncertificates. Any problematic use-cases would have to be using an \"exotic\"\ncurve encoding.\n\nThe affected APIs include: EC_GROUP_new_curve_GF2m(), EC_GROUP_new_from_params(),\nand various supporting BN_GF2m_*() functions.\n\nApplications working with \"exotic\" explicit binary (GF(2^m)) curve parameters,\nthat make it possible to represent invalid field polynomials with a zero\nconstant term, via the above or similar APIs, may terminate abruptly as a\nresult of reading or writing outside of array bounds. Remote code execution\ncannot easily be ruled out.\n\nThe FIPS modules in 3.3, 3.2, 3.1 and 3.0 are not affected by this issue.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Critical",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-12-28"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-12-28"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2023-08615",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||
"CWE": "CWE-325, CWE-754",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-08615",
|
||
"Impact": "Low",
|
||
"Public": "20231106"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-01337",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-476",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-01337",
|
||
"Impact": "Low",
|
||
"Public": "20231123"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-04109",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-404",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-04109",
|
||
"Impact": "Low",
|
||
"Public": "20240408"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-05176",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-416",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-05176",
|
||
"Impact": "High",
|
||
"Public": "20240510"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-06988",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-06988",
|
||
"Impact": "Critical",
|
||
"Public": "20240502"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-08755",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
||
"CWE": "CWE-119, CWE-787",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-08755",
|
||
"Impact": "High",
|
||
"Public": "20241016"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2023-5678",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||
"CWE": "CWE-754",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-5678",
|
||
"Impact": "Low",
|
||
"Public": "20231106"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-0727",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "NVD-CWE-noinfo",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-0727",
|
||
"Impact": "Low",
|
||
"Public": "20240126"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-2511",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-2511",
|
||
"Impact": "None",
|
||
"Public": "20240408"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-4741",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-4741",
|
||
"Impact": "None",
|
||
"Public": "20241113"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-5535",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-5535",
|
||
"Impact": "None",
|
||
"Public": "20240627"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-9143",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-9143",
|
||
"Impact": "None",
|
||
"Public": "20241016"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:5001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181001",
|
||
"Comment": "libcrypto1.1 is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181002",
|
||
"Comment": "libssl-devel is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181003",
|
||
"Comment": "libssl-devel-static is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181004",
|
||
"Comment": "libssl1.1 is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181005",
|
||
"Comment": "openssl is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181006",
|
||
"Comment": "openssl-doc is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181007",
|
||
"Comment": "openssl-engines is earlier than 0:1.1.1w-alt0.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202417181008",
|
||
"Comment": "tsget is earlier than 0:1.1.1w-alt0.p10.2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |