523 lines
27 KiB
JSON
523 lines
27 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20172801",
|
||
"Version": "oval:org.altlinux.errata:def:20172801",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2017-2801: package `salt` update to version 2018.2-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2017-2801",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2017-2801",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2019-02464",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2019-02464",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01180",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01180",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01308",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01308",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01900",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01900",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01902",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01902",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01903",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01903",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-05977",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-05977",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06340",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06340",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06341",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06341",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06345",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06345",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06348",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06348",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-00038",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-00038",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-07041",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-07041",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-07060",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-07060",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2017-14695",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-14695",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2017-14696",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-14696",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-15750",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-15750",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2018-15751",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-15751",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-16846",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-16846",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-17490",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-17490",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-25592",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-25592",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-28243",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-28243",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-28972",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-28972",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-35662",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-35662",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25281",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25281",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25282",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25282",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25283",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25283",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25284",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25284",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3144",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3144",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3148",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3148",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3197",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3197",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades salt to version 2018.2-alt1. \nSecurity Fix(es):\n\n * BDU:2019-02464: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с недостатками процедуры аутентификации, позволяющая нарушителю обойти процедуру аутентификации или выполнить произвольные команды\n\n * BDU:2021-01180: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю выполнить атаку типа «человек посередине»\n\n * BDU:2021-01308: Уязвимость компонента salt-api системы управления конфигурациями SaltStack, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2021-01900: Уязвимость компонента salt-netapi системы управления конфигурациями и удалённого выполнения операций Salt, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2021-01902: Уязвимость модуля TLS системы управления конфигурациями и удалённого выполнения операций Salt, связанная с неправильным присвоением разрешений для критичного ресурса, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2021-01903: Уязвимость системы управления конфигурациями и удалённого выполнения операций Salt, связанная с отсутствием мер по нейтрализации специальных элементов, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2021-05977: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с неправильным ограничением доступа, позволяющая нарушителю получить несанкционированный доступ к другим ограниченным функциям\n\n * BDU:2021-06340: Уязвимость функции salt.utils.thin.gen_thin() системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю выполнять произвольные команды в целевой системе\n\n * BDU:2021-06341: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю локально повысить привилегии.\n\n * BDU:2021-06345: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю выполнять произвольные команды с повышенными привилегиями\n\n * BDU:2021-06348: Уязвимость компонента wheel.pillar_roots.write системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками при проверке вводимых данных, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2022-00038: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками при обработке запросов аутентификации для истекших токенов eauth, позволяющая нарушителю выполнить произвольные команды\n\n * BDU:2022-07041: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю выполнить атаку типа «человек посередине»\n\n * BDU:2022-07060: Уязвимость реализации метода salt.wheel.pillar_roots.write системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю раскрыть защищаемую информацию\n\n * CVE-2017-14695: Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID. NOTE: this vulnerability exists because of an incomplete fix for CVE-2017-12791.\n\n * CVE-2017-14696: SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote attackers to cause a denial of service via a crafted authentication request.\n\n * CVE-2018-15750: Directory Traversal vulnerability in salt-api in SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allows remote attackers to determine which files exist on the server.\n\n * CVE-2018-15751: SaltStack Salt before 2017.7.8 and 2018.3.x before 2018.3.3 allow remote attackers to bypass authentication and execute arbitrary commands via salt-api(netapi).\n\n * CVE-2020-16846: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.\n\n * CVE-2020-17490: The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.\n\n * CVE-2020-25592: In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.\n\n * CVE-2020-28243: An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.\n\n * CVE-2020-28972: In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.\n\n * CVE-2020-35662: In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.\n\n * CVE-2021-25281: An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.\n\n * CVE-2021-25282: An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.\n\n * CVE-2021-25283: An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.\n\n * CVE-2021-25284: An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.\n\n * CVE-2021-3144: In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)\n\n * CVE-2021-3148: An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.\n\n * CVE-2021-3197: An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Critical",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2017-12-14"
|
||
},
|
||
"Updated": {
|
||
"Date": "2017-12-14"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2019-02464",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://bdu.fstec.ru/vul/2019-02464",
|
||
"Impact": "Critical",
|
||
"Public": "20181024"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01180",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01180",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01308",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01308",
|
||
"Impact": "Low",
|
||
"Public": "20181024"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01900",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01900",
|
||
"Impact": "Critical",
|
||
"Public": "20200915"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01902",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-732",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01902",
|
||
"Impact": "Low",
|
||
"Public": "20200811"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01903",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01903",
|
||
"Impact": "Critical",
|
||
"Public": "20201102"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-05977",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-05977",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06340",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06340",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06341",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06341",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06345",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06345",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06348",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-94",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06348",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-00038",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-613",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-00038",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-07041",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-07041",
|
||
"Impact": "High",
|
||
"Public": "20210225"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-07060",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-07060",
|
||
"Impact": "Critical",
|
||
"Public": "20210225"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2017-14695",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-14695",
|
||
"Impact": "Critical",
|
||
"Public": "20171024"
|
||
},
|
||
{
|
||
"ID": "CVE-2017-14696",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-14696",
|
||
"Impact": "High",
|
||
"Public": "20171024"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-15750",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-15750",
|
||
"Impact": "Low",
|
||
"Public": "20181024"
|
||
},
|
||
{
|
||
"ID": "CVE-2018-15751",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-15751",
|
||
"Impact": "Critical",
|
||
"Public": "20181024"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-16846",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-16846",
|
||
"Impact": "Critical",
|
||
"Public": "20201106"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-17490",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-732",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-17490",
|
||
"Impact": "Low",
|
||
"Public": "20201106"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-25592",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-25592",
|
||
"Impact": "Critical",
|
||
"Public": "20201106"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-28243",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-28243",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-28972",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-28972",
|
||
"Impact": "Low",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-35662",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-35662",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25281",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25281",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25282",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25282",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25283",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-94",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25283",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25284",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
|
||
"CWE": "CWE-532",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25284",
|
||
"Impact": "Low",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3144",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-613",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3144",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3148",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3148",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3197",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3197",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20172801001",
|
||
"Comment": "python-module-salt is earlier than 0:2018.2-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20172801002",
|
||
"Comment": "python-module-salt-tests is earlier than 0:2018.2-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20172801003",
|
||
"Comment": "salt-api is earlier than 0:2018.2-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20172801004",
|
||
"Comment": "salt-master is earlier than 0:2018.2-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20172801005",
|
||
"Comment": "salt-minion is earlier than 0:2018.2-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |