112 lines
4.2 KiB
JSON
112 lines
4.2 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20163246",
|
|
"Version": "oval:org.altlinux.errata:def:20163246",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2016-3246: package `qpid-proton` update to version 0.14.0-alt1",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2016-3246",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2016-3246",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2016-2166",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-2166",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2016-4467",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-4467",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades qpid-proton to version 0.14.0-alt1. \nSecurity Fix(es):\n\n * CVE-2016-2166: The (1) proton.reactor.Connector, (2) proton.reactor.Container, and (3) proton.utils.BlockingConnection classes in Apache Qpid Proton before 0.12.1 improperly use an unencrypted connection for an amqps URI scheme when SSL support is unavailable, which might allow man-in-the-middle attackers to obtain sensitive information or modify data via unspecified vectors.\n\n * CVE-2016-4467: The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate when using the SChannel-based security layer, which allows man-in-the-middle attackers to spoof servers via an arbitrary valid certificate.",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "Low",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2024-04-05"
|
|
},
|
|
"Updated": {
|
|
"Date": "2024-04-05"
|
|
},
|
|
"BDUs": null,
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2016-2166",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
|
"CVSS3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
|
|
"CWE": "CWE-200",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-2166",
|
|
"Impact": "Low",
|
|
"Public": "20160412"
|
|
},
|
|
{
|
|
"ID": "CVE-2016-4467",
|
|
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"CVSS3": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
|
"CWE": "CWE-295",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-4467",
|
|
"Impact": "Low",
|
|
"Public": "20170502"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20163246001",
|
|
"Comment": "libqpid-proton is earlier than 0:0.14.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20163246002",
|
|
"Comment": "libqpid-proton-devel is earlier than 0:0.14.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20163246003",
|
|
"Comment": "perl-qpid_proton is earlier than 0:0.14.0-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20163246004",
|
|
"Comment": "python-module-qpid-proton is earlier than 0:0.14.0-alt1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |