127 lines
4.8 KiB
JSON
127 lines
4.8 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20162481",
|
||
"Version": "oval:org.altlinux.errata:def:20162481",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2016-2481: package `hostapd` update to version 2.6-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p11"
|
||
],
|
||
"Products": [
|
||
"ALT Container"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2016-2481",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2016-2481",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01305",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01305",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2016-10743",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-10743",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2016-4476",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-4476",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-10064",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-10064",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades hostapd to version 2.6-alt1. \nSecurity Fix(es):\n\n * BDU:2021-01305: Уязвимость функции rand() and random() программной сертификации устройств беспроводной сети WPA, связанная с недостатком в энтропии в выборе PIN, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2016-10743: hostapd before 2.6 does not prevent use of the low-quality PRNG that is reached by an os_random() function call.\n\n * CVE-2016-4476: hostapd 0.6.7 through 2.5 and wpa_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows remote attackers to cause a denial of service (daemon outage) via a crafted WPS operation.\n\n * CVE-2019-10064: hostapd before 2.6, in EAP mode, makes calls to the rand() and random() standard library functions without any preceding srand() or srandom() call, which results in inappropriate use of deterministic values. This was fixed in conjunction with CVE-2016-10743.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2016-12-23"
|
||
},
|
||
"Updated": {
|
||
"Date": "2016-12-23"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2021-01305",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||
"CWE": "CWE-331",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01305",
|
||
"Impact": "Low",
|
||
"Public": "20200228"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2016-10743",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
|
||
"CWE": "CWE-332",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-10743",
|
||
"Impact": "High",
|
||
"Public": "20190323"
|
||
},
|
||
{
|
||
"ID": "CVE-2016-4476",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-4476",
|
||
"Impact": "High",
|
||
"Public": "20160509"
|
||
},
|
||
{
|
||
"ID": "CVE-2019-10064",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-331",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-10064",
|
||
"Impact": "High",
|
||
"Public": "20200228"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:container:11"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20162481001",
|
||
"Comment": "hostapd is earlier than 0:2.6-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |