90 lines
3.1 KiB
JSON
90 lines
3.1 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20172185",
|
|
"Version": "oval:org.altlinux.errata:def:20172185",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2017-2185: package `qbittorrent` update to version 3.3.16-alt1",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2017-2185",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2017-2185",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2017-12778",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-12778",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades qbittorrent to version 3.3.16-alt1. \nSecurity Fix(es):\n\n * CVE-2017-12778: The UI Lock feature in qBittorrent version 3.3.15 is vulnerable to Authentication Bypass, which allows Attack to gain unauthorized access to qBittorrent functions by tampering the affected flag value of the config file at the C:\\Users\\\u003cusername\u003e\\Roaming\\qBittorrent pathname. The attacker must change the value of the \"locked\" attribute to \"false\" within the \"Locking\" stanza. NOTE: This is an intended behavior. See https://github.com/qbittorrent/qBittorrent/wiki/I-forgot-my-UI-lock-password",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "High",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2017-09-11"
|
|
},
|
|
"Updated": {
|
|
"Date": "2017-09-11"
|
|
},
|
|
"BDUs": null,
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2017-12778",
|
|
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:N",
|
|
"CVSS3": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
|
|
"CWE": "CWE-287",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-12778",
|
|
"Impact": "High",
|
|
"Public": "20190509"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20172185001",
|
|
"Comment": "qbittorrent is earlier than 1:3.3.16-alt1"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20172185002",
|
|
"Comment": "qbittorrent-nox is earlier than 1:3.3.16-alt1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |