2024-04-16 14:26:14 +00:00

257 lines
13 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20235121",
"Version": "oval:org.altlinux.errata:def:20235121",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2023-5121: package `c-ares` update to version 1.19.1-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c10f1"
],
"Products": [
"ALT SP Workstation",
"ALT SP Server"
]
}
],
"References": [
{
"RefID": "ALT-PU-2023-5121",
"RefURL": "https://errata.altlinux.org/ALT-PU-2023-5121",
"Source": "ALTPU"
},
{
"RefID": "BDU:2018-00106",
"RefURL": "https://bdu.fstec.ru/vul/2018-00106",
"Source": "BDU"
},
{
"RefID": "BDU:2021-04594",
"RefURL": "https://bdu.fstec.ru/vul/2021-04594",
"Source": "BDU"
},
{
"RefID": "BDU:2023-01258",
"RefURL": "https://bdu.fstec.ru/vul/2023-01258",
"Source": "BDU"
},
{
"RefID": "BDU:2023-05898",
"RefURL": "https://bdu.fstec.ru/vul/2023-05898",
"Source": "BDU"
},
{
"RefID": "CVE-2016-5180",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-5180",
"Source": "CVE"
},
{
"RefID": "CVE-2017-1000381",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000381",
"Source": "CVE"
},
{
"RefID": "CVE-2020-14354",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-14354",
"Source": "CVE"
},
{
"RefID": "CVE-2020-22217",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-22217",
"Source": "CVE"
},
{
"RefID": "CVE-2022-4904",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904",
"Source": "CVE"
},
{
"RefID": "CVE-2023-31124",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-31124",
"Source": "CVE"
},
{
"RefID": "CVE-2023-31130",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-31130",
"Source": "CVE"
},
{
"RefID": "CVE-2023-31147",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-31147",
"Source": "CVE"
},
{
"RefID": "CVE-2023-32067",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-32067",
"Source": "CVE"
}
],
"Description": "This update upgrades c-ares to version 1.19.1-alt1. \nSecurity Fix(es):\n\n * BDU:2018-00106: Уязвимость функции ares_parse_naptr_reply библиотеки асинхронных DNS-запросов c-ares, позволяющая нарушителю выполнить чтение за границами буфера в памяти\n\n * BDU:2021-04594: Уязвимость функций ares_destroy() и ares_getaddrinfo() библиотеки асинхронных DNS-запросов C-ares, связанная с использованием памяти после её освобождения, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2023-01258: Уязвимость функции ares_set_sortlist библиотеки асинхронных DNS-запросов c-ares, позволяющая нарушителю вызвать отказ в обслуживании или оказать ограниченное влияния на конфиденциальность и целостность\n\n * BDU:2023-05898: Уязвимость функции ares_parse_soa_reply() библиотеки асинхронных DNS-запросов C-ares, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * CVE-2016-5180: Heap-based buffer overflow in the ares_create_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly execute arbitrary code via a hostname with an escaped trailing dot.\n\n * CVE-2017-1000381: The c-ares function `ares_parse_naptr_reply()`, which is used for parsing NAPTR responses, could be triggered to read memory outside of the given input buffer if the passed in DNS response packet was crafted in a particular way.\n\n * CVE-2020-14354: A possible use-after-free and double-free in c-ares lib version 1.16.0 if ares_destroy() is called prior to ares_getaddrinfo() completing. This flaw possibly allows an attacker to crash the service that uses c-ares lib. The highest threat from this vulnerability is to this service availability.\n\n * CVE-2020-22217: Buffer overflow vulnerability in c-ares before 1_16_1 thru 1_17_0 via function ares_parse_soa_reply in ares_parse_soa_reply.c.\n\n * CVE-2022-4904: A flaw was found in the c-ares package. The ares_set_sortlist is missing checks about the validity of the input string, which allows a possible arbitrary length stack overflow. This issue may cause a denial of service or a limited impact on confidentiality and integrity.\n\n * CVE-2023-31124: c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARES_RANDOM_FILE will not be set, as seen when cross compiling aarch64 android. This will downgrade to using rand() as a fallback which could allow an attacker to take advantage of the lack of entropy by not using a CSPRNG. This issue was patched in version 1.19.1.\n\n\n * CVE-2023-31130: c-ares is an asynchronous resolver library. ares_inet_net_pton() is vulnerable to a buffer underflow for certain ipv6 addresses, in particular \"0::00:00:00/2\" was found to cause an issue. C-ares only uses this function internally for configuration purposes which would require an administrator to configure such an address via ares_set_sortlist(). However, users may externally use ares_inet_net_pton() for other purposes and thus be vulnerable to more severe issues. This issue has been fixed in 1.19.1.\n\n\n * CVE-2023-31147: c-ares is an asynchronous resolver library. When /dev/urandom or RtlGenRandom() are unavailable, c-ares uses rand() to generate random numbers used for DNS query ids. This is not a CSPRNG, and it is also not seeded by srand() so will generate predictable output. Input from the random number generator is fed into a non-compilant RC4 implementation and may not be as strong as the original RC4 implementation. No attempt is made to look for modern OS-provided CSPRNGs like arc4random() that is widely available. This issue has been fixed in version 1.19.1.\n\n * CVE-2023-32067: c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of service. If a target resolver sends a query, the attacker forges a malformed UDP packet with a length of 0 and returns them to the target resolver. The target resolver erroneously interprets the 0 length as a graceful shutdown of the connection. This issue has been patched in version 1.19.1.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2023-08-28"
},
"Updated": {
"Date": "2024-04-04"
},
"BDUs": [
{
"ID": "BDU:2018-00106",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-125",
"Href": "https://bdu.fstec.ru/vul/2018-00106",
"Impact": "High",
"Public": "20170520"
},
{
"ID": "BDU:2021-04594",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"CWE": "CWE-416",
"Href": "https://bdu.fstec.ru/vul/2021-04594",
"Impact": "Low",
"Public": "20200507"
},
{
"ID": "BDU:2023-01258",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"CWE": "CWE-20, CWE-119",
"Href": "https://bdu.fstec.ru/vul/2023-01258",
"Impact": "High",
"Public": "20230306"
},
{
"ID": "BDU:2023-05898",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-120, CWE-787",
"Href": "https://bdu.fstec.ru/vul/2023-05898",
"Impact": "Critical",
"Public": "20200521"
}
],
"CVEs": [
{
"ID": "CVE-2016-5180",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-5180",
"Impact": "Critical",
"Public": "20161003"
},
{
"ID": "CVE-2017-1000381",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"CWE": "CWE-200",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000381",
"Impact": "High",
"Public": "20170707"
},
{
"ID": "CVE-2020-14354",
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"CWE": "CWE-415",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-14354",
"Impact": "Low",
"Public": "20210513"
},
{
"ID": "CVE-2020-22217",
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-125",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-22217",
"Impact": "Low",
"Public": "20230822"
},
{
"ID": "CVE-2022-4904",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"CWE": "CWE-1284",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-4904",
"Impact": "High",
"Public": "20230306"
},
{
"ID": "CVE-2023-31124",
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CWE": "CWE-330",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-31124",
"Impact": "Low",
"Public": "20230525"
},
{
"ID": "CVE-2023-31130",
"CVSS3": "CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-31130",
"Impact": "Low",
"Public": "20230525"
},
{
"ID": "CVE-2023-31147",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"CWE": "CWE-330",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-31147",
"Impact": "Low",
"Public": "20230525"
},
{
"ID": "CVE-2023-32067",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "NVD-CWE-noinfo",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-32067",
"Impact": "High",
"Public": "20230525"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:10",
"cpe:/o:alt:spserver:10"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20235121001",
"Comment": "c-ares is earlier than 0:1.19.1-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20235121002",
"Comment": "libcares is earlier than 0:1.19.1-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20235121003",
"Comment": "libcares-devel is earlier than 0:1.19.1-alt1"
}
]
}
]
}
}
]
}