pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vuln-list-alt/oval/c9f2/ALT-PU-2019-3402/definitions.json
pepelyaevip 9d72b75f75 ALT Vulnerability
2024-12-12 21:07:30 +00:00

353 lines
17 KiB
JSON
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20193402",
"Version": "oval:org.altlinux.errata:def:20193402",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2019-3402: package `apache2` update to version 2.4.41-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c9f2"
],
"Products": [
"ALT SPWorkstation",
"ALT SPServer"
]
}
],
"References": [
{
"RefID": "ALT-PU-2019-3402",
"RefURL": "https://errata.altlinux.org/ALT-PU-2019-3402",
"Source": "ALTPU"
},
{
"RefID": "BDU:2019-03632",
"RefURL": "https://bdu.fstec.ru/vul/2019-03632",
"Source": "BDU"
},
{
"RefID": "BDU:2019-03647",
"RefURL": "https://bdu.fstec.ru/vul/2019-03647",
"Source": "BDU"
},
{
"RefID": "BDU:2019-03652",
"RefURL": "https://bdu.fstec.ru/vul/2019-03652",
"Source": "BDU"
},
{
"RefID": "BDU:2019-03780",
"RefURL": "https://bdu.fstec.ru/vul/2019-03780",
"Source": "BDU"
},
{
"RefID": "BDU:2019-04286",
"RefURL": "https://bdu.fstec.ru/vul/2019-04286",
"Source": "BDU"
},
{
"RefID": "BDU:2019-04287",
"RefURL": "https://bdu.fstec.ru/vul/2019-04287",
"Source": "BDU"
},
{
"RefID": "BDU:2020-01010",
"RefURL": "https://bdu.fstec.ru/vul/2020-01010",
"Source": "BDU"
},
{
"RefID": "CVE-2019-10081",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-10081",
"Source": "CVE"
},
{
"RefID": "CVE-2019-10082",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-10082",
"Source": "CVE"
},
{
"RefID": "CVE-2019-10092",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-10092",
"Source": "CVE"
},
{
"RefID": "CVE-2019-10098",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-10098",
"Source": "CVE"
},
{
"RefID": "CVE-2019-9517",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517",
"Source": "CVE"
}
],
"Description": "This update upgrades apache2 to version 2.4.41-alt1. \nSecurity Fix(es):\n\n * BDU:2019-03632: Уязвимость реализации сетевого протокола HTTP/2 веб-сервера Apache HTTP Server, связанная с чтением за границами буфера в памяти, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2019-03647: Уязвимость сетевого протокола HTTP/2 веб-сервера Apache Traffic Server, программной платформы Node.js, связанная с недостатком механизма контроля расхода ресурсов, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2019-03652: Уязвимость функции mod_rewrite веб-сервера Apache HTTP Server, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации или оказать воздействие на доступность информации\n\n * BDU:2019-03780: Уязвимость реализации сетевого протокола HTTP/2 веб-сервера Apache HTTP Server, связанная с неконтролируемым расходом ресурса, позволяющая нарушителю раскрыть защищаемую информацию\n\n * BDU:2019-04286: Уязвимость модуля mod_proxy веб-сервера Apache HTTP Server, позволяющая нарушителю перенаправить пользователя на вредоносный сайт с помощью специально сформированной веб-страницы\n\n * BDU:2019-04287: Уязвимость реализации сетевого протокола HTTP/2 веб-сервера Apache HTTP Server, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2020-01010: Уязвимость функции mod_rewrite веб-сервера Apache HTTP Server, позволяющая нарушителю получить несанкционированный доступ к конфиденциальной информации или оказать воздействие на целостность информации\n\n * CVE-2019-10081: HTTP/2 (2.4.20 through 2.4.39) very early pushes, for example configured with \"H2PushResource\", could lead to an overwrite of memory in the pushing request's pool, leading to crashes. The memory copied is that of the configured push link header values, not data supplied by the client.\n\n * CVE-2019-10082: In Apache HTTP Server 2.4.18-2.4.39, using fuzzed network input, the http/2 session handling could be made to read memory after being freed, during connection shutdown.\n\n * CVE-2019-10092: In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the link on the error page to be malformed and instead point to a page of their choice. This would only be exploitable where a server was set up with proxying enabled but was misconfigured in such a way that the Proxy Error page was displayed.\n\n * CVE-2019-10098: In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.\n\n * CVE-2019-9517: Some HTTP/2 implementations are vulnerable to unconstrained interal data buffering, potentially leading to a denial of service. The attacker opens the HTTP/2 window so the peer can send without constraint; however, they leave the TCP window closed so the peer cannot actually write (many of) the bytes on the wire. The attacker then sends a stream of requests for a large response object. Depending on how the servers queue the responses, this can consume excess memory, CPU, or both.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2019-12-27"
},
"Updated": {
"Date": "2019-12-27"
},
"BDUs": [
{
"ID": "BDU:2019-03632",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-119",
"Href": "https://bdu.fstec.ru/vul/2019-03632",
"Impact": "High",
"Public": "20190815"
},
{
"ID": "BDU:2019-03647",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-400",
"Href": "https://bdu.fstec.ru/vul/2019-03647",
"Impact": "High",
"Public": "20190410"
},
{
"ID": "BDU:2019-03652",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-601",
"Href": "https://bdu.fstec.ru/vul/2019-03652",
"Impact": "Low",
"Public": "20190326"
},
{
"ID": "BDU:2019-03780",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-400",
"Href": "https://bdu.fstec.ru/vul/2019-03780",
"Impact": "High",
"Public": "20190320"
},
{
"ID": "BDU:2019-04286",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://bdu.fstec.ru/vul/2019-04286",
"Impact": "Low",
"Public": "20190709"
},
{
"ID": "BDU:2019-04287",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"CWE": "CWE-416",
"Href": "https://bdu.fstec.ru/vul/2019-04287",
"Impact": "Critical",
"Public": "20190412"
},
{
"ID": "BDU:2020-01010",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-601",
"Href": "https://bdu.fstec.ru/vul/2020-01010",
"Impact": "Low",
"Public": "20190925"
}
],
"CVEs": [
{
"ID": "CVE-2019-10081",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-10081",
"Impact": "High",
"Public": "20190815"
},
{
"ID": "CVE-2019-10082",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"CWE": "CWE-416",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-10082",
"Impact": "Critical",
"Public": "20190926"
},
{
"ID": "CVE-2019-10092",
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-79",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-10092",
"Impact": "Low",
"Public": "20190926"
},
{
"ID": "CVE-2019-10098",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"CWE": "CWE-601",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-10098",
"Impact": "Low",
"Public": "20190925"
},
{
"ID": "CVE-2019-9517",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-770",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-9517",
"Impact": "High",
"Public": "20190813"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:8.4",
"cpe:/o:alt:spserver:8.4"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20193402001",
"Comment": "apache2 is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402002",
"Comment": "apache2-ab is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402003",
"Comment": "apache2-base is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402004",
"Comment": "apache2-cgi-bin is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402005",
"Comment": "apache2-cgi-bin-printenv is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402006",
"Comment": "apache2-cgi-bin-test-cgi is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402007",
"Comment": "apache2-compat is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402008",
"Comment": "apache2-configs-A1PROXIED is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402009",
"Comment": "apache2-datadirs is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402010",
"Comment": "apache2-devel is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402011",
"Comment": "apache2-docs is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402012",
"Comment": "apache2-full is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402013",
"Comment": "apache2-htcacheclean is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402014",
"Comment": "apache2-htcacheclean-control is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402015",
"Comment": "apache2-html is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402016",
"Comment": "apache2-htpasswd is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402017",
"Comment": "apache2-httpd-event is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402018",
"Comment": "apache2-httpd-prefork is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402019",
"Comment": "apache2-httpd-worker is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402020",
"Comment": "apache2-icons is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402021",
"Comment": "apache2-manual is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402022",
"Comment": "apache2-manual-addons is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402023",
"Comment": "apache2-mod_cache_disk is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402024",
"Comment": "apache2-mod_ldap is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402025",
"Comment": "apache2-mod_ssl is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402026",
"Comment": "apache2-mod_ssl-compat is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402027",
"Comment": "apache2-mods is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402028",
"Comment": "apache2-suexec is earlier than 1:2.4.41-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20193402029",
"Comment": "rpm-build-apache2 is earlier than 1:2.4.41-alt1"
}
]
}
]
}
}
]
}
Reference in New Issue View Git Blame Copy Permalink