293 lines
13 KiB
JSON
293 lines
13 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20201914",
|
||
"Version": "oval:org.altlinux.errata:def:20201914",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2020-1914: package `python` update to version 2.7.18-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2020-1914",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-1914",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-03708",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-03708",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-03715",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-03715",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-03740",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-03740",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-18348",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-18348",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-8492",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-8492",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3426",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3426",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades python to version 2.7.18-alt1. \nSecurity Fix(es):\n\n * BDU:2021-03708: Уязвимость модуля pandoc языка программирования Python, связанная с раскрытием информации, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2021-03715: Уязвимость модуля urllib2 языка программирования Python, связанная с недостаточной нейтрализацией специальных элементов в запросе, позволяющая нарушителю оказать воздействие на целостность данных\n\n * BDU:2021-03740: Уязвимость интерпретатора языка программирования Python, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2019-18348: An issue was discovered in urllib2 in Python 2.x through 2.7.17 and urllib in Python 3.x through 3.8.0. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the host component of a URL) followed by an HTTP header. This is similar to the CVE-2019-9740 query string issue and the CVE-2019-9947 path string issue. (This is not exploitable when glibc has CVE-2016-10739 fixed.). This is fixed in: v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1; v3.6.11, v3.6.11rc1, v3.6.12; v3.7.8, v3.7.8rc1, v3.7.9; v3.8.3, v3.8.3rc1, v3.8.4, v3.8.4rc1, v3.8.5, v3.8.6, v3.8.6rc1.\n\n * CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.\n\n * CVE-2021-3426: There's a flaw in Python 3's pydoc. A local or adjacent attacker who discovers or is able to convince another local or adjacent user to start a pydoc server could access the server and use it to disclose sensitive information belonging to the other user that they would not normally be able to access. The highest risk of this flaw is to data confidentiality. This flaw affects Python versions before 3.8.9, Python versions before 3.9.3 and Python versions before 3.10.0a7.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Low",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2020-05-05"
|
||
},
|
||
"Updated": {
|
||
"Date": "2020-05-05"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2021-03708",
|
||
"CVSS": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
|
||
"CVSS3": "AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-200",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-03708",
|
||
"Impact": "Low",
|
||
"Public": "20210520"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-03715",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-03715",
|
||
"Impact": "Low",
|
||
"Public": "20191023"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-03740",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-400",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-03740",
|
||
"Impact": "Low",
|
||
"Public": "20200911"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2019-18348",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-18348",
|
||
"Impact": "Low",
|
||
"Public": "20191023"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-8492",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-400",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-8492",
|
||
"Impact": "Low",
|
||
"Public": "20200130"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3426",
|
||
"CVSS": "AV:A/AC:L/Au:S/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3426",
|
||
"Impact": "Low",
|
||
"Public": "20210520"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914001",
|
||
"Comment": "libpython is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914002",
|
||
"Comment": "python is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914003",
|
||
"Comment": "python-dev is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914004",
|
||
"Comment": "python-devel-static is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914005",
|
||
"Comment": "python-modules is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914006",
|
||
"Comment": "python-modules-bsddb is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914007",
|
||
"Comment": "python-modules-compiler is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914008",
|
||
"Comment": "python-modules-ctypes is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914009",
|
||
"Comment": "python-modules-curses is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914010",
|
||
"Comment": "python-modules-distutils is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914011",
|
||
"Comment": "python-modules-email is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914012",
|
||
"Comment": "python-modules-encodings is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914013",
|
||
"Comment": "python-modules-ensurepip is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914014",
|
||
"Comment": "python-modules-hotshot is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914015",
|
||
"Comment": "python-modules-json is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914016",
|
||
"Comment": "python-modules-logging is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914017",
|
||
"Comment": "python-modules-multiprocessing is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914018",
|
||
"Comment": "python-modules-nis is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914019",
|
||
"Comment": "python-modules-sqlite3 is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914020",
|
||
"Comment": "python-modules-tkinter is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914021",
|
||
"Comment": "python-modules-unittest is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914022",
|
||
"Comment": "python-modules-wsgiref is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914023",
|
||
"Comment": "python-modules-xml is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914024",
|
||
"Comment": "python-relaxed is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914025",
|
||
"Comment": "python-strict is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914026",
|
||
"Comment": "python-test is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914027",
|
||
"Comment": "python-tools-2to3 is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914028",
|
||
"Comment": "python-tools-i18n is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914029",
|
||
"Comment": "python-tools-idle is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914030",
|
||
"Comment": "python-tools-pynche is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914031",
|
||
"Comment": "python-tools-scripts is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914032",
|
||
"Comment": "python-tools-smtpd is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914033",
|
||
"Comment": "python-tools-webchecker is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914034",
|
||
"Comment": "python-user-scripts is earlier than 0:2.7.18-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20201914035",
|
||
"Comment": "python2-base is earlier than 0:2.7.18-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |