vuln-list-alt/oval/p11/ALT-PU-2020-1648/definitions.json
2024-12-12 21:07:30 +00:00

131 lines
5.1 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20201648",
"Version": "oval:org.altlinux.errata:def:20201648",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2020-1648: package `gnutls30` update to version 3.6.13-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p11"
],
"Products": [
"ALT Container"
]
}
],
"References": [
{
"RefID": "ALT-PU-2020-1648",
"RefURL": "https://errata.altlinux.org/ALT-PU-2020-1648",
"Source": "ALTPU"
},
{
"RefID": "BDU:2020-02038",
"RefURL": "https://bdu.fstec.ru/vul/2020-02038",
"Source": "BDU"
},
{
"RefID": "CVE-2020-11501",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-11501",
"Source": "CVE"
}
],
"Description": "This update upgrades gnutls30 to version 3.6.13-alt1. \nSecurity Fix(es):\n\n * BDU:2020-02038: Уязвимость функции send_client_hello (handshake.c) криптографической библиотеки GnuTLS, связанная с недостатками используемых криптографических алгоритмов, позволяющая нарушителю получить несанкционированный доступ к конфиденциальным данным или оказать воздействие на целостность данных\n\n * CVE-2020-11501: GnuTLS 3.6.x before 3.6.13 uses incorrect cryptography for DTLS. The earliest affected version is 3.6.3 (2018-07-16) because of an error in a 2017-10-06 commit. The DTLS client always uses 32 '\\0' bytes instead of a random value, and thus contributes no randomness to a DTLS negotiation. This breaks the security guarantees of the DTLS protocol.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2020-03-31"
},
"Updated": {
"Date": "2020-03-31"
},
"BDUs": [
{
"ID": "BDU:2020-02038",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"CWE": "CWE-327",
"Href": "https://bdu.fstec.ru/vul/2020-02038",
"Impact": "Critical",
"Public": "20200403"
}
],
"CVEs": [
{
"ID": "CVE-2020-11501",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"CWE": "CWE-330",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-11501",
"Impact": "High",
"Public": "20200403"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:container:11"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:3001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20201648001",
"Comment": "gnutls-utils is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648002",
"Comment": "gnutls30-devel-doc is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648003",
"Comment": "libgnutls-devel is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648004",
"Comment": "libgnutls-guile is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648005",
"Comment": "libgnutls-openssl-devel is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648006",
"Comment": "libgnutls27-openssl is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648007",
"Comment": "libgnutls30 is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648008",
"Comment": "libgnutlsxx-devel is earlier than 0:3.6.13-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20201648009",
"Comment": "libgnutlsxx28 is earlier than 0:3.6.13-alt1"
}
]
}
]
}
}
]
}