104 lines
3.5 KiB
JSON
104 lines
3.5 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20163250",
|
||
"Version": "oval:org.altlinux.errata:def:20163250",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2016-3250: package `apache-commons-fileupload` update to version 1.3.2-alt1_1jpp8",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2016-3250",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2016-3250",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2016-01698",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2016-01698",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2016-3092",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades apache-commons-fileupload to version 1.3.2-alt1_1jpp8. \nSecurity Fix(es):\n\n * BDU:2016-01698: Уязвимость библиотеки Сommons FileUpload, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2016-3092: The MultipartStream class in Apache Commons Fileupload before 1.3.2, as used in Apache Tomcat 7.x before 7.0.70, 8.x before 8.0.36, 8.5.x before 8.5.3, and 9.x before 9.0.0.M7 and other products, allows remote attackers to cause a denial of service (CPU consumption) via a long boundary string.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-05-27"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-05-27"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2016-01698",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://bdu.fstec.ru/vul/2016-01698",
|
||
"Impact": "High",
|
||
"Public": "20160705"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2016-3092",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-3092",
|
||
"Impact": "High",
|
||
"Public": "20160704"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20163250001",
|
||
"Comment": "apache-commons-fileupload is earlier than 1:1.3.2-alt1_1jpp8"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20163250002",
|
||
"Comment": "apache-commons-fileupload-javadoc is earlier than 1:1.3.2-alt1_1jpp8"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |