152 lines
6.6 KiB
JSON
152 lines
6.6 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20247315",
|
||
"Version": "oval:org.altlinux.errata:def:20247315",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2024-7315: package `openssh-gostcrypto` update to version 7.9p1-alt4.gost.p10.2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2024-7315",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-7315",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-03837",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-03837",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-08955",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-08955",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-41617",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-41617",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-51385",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-51385",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades openssh-gostcrypto to version 7.9p1-alt4.gost.p10.2. \nSecurity Fix(es):\n\n * BDU:2023-03837: Уязвимость средства криптографической защиты OpenSSH, связанная с небезопасным управлением привилегиями, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2023-08955: Уязвимость cредства криптографической защиты OpenSSH, связанная с внедрением или модификацией аргумента, позволяющая нарушителю выполнить произвольные команды\n\n * CVE-2021-41617: sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user.\n\n * CVE-2023-51385: In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, and this name is referenced by an expansion token in certain situations. For example, an untrusted Git repository can have a submodule with shell metacharacters in a user name or host name.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-05-03"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-05-03"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2023-03837",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-269",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-03837",
|
||
"Impact": "High",
|
||
"Public": "20210926"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-08955",
|
||
"CVSS": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
|
||
"CWE": "CWE-74, CWE-78, CWE-707",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-08955",
|
||
"Impact": "Low",
|
||
"Public": "20231218"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2021-41617",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-41617",
|
||
"Impact": "High",
|
||
"Public": "20210926"
|
||
},
|
||
{
|
||
"ID": "CVE-2023-51385",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-51385",
|
||
"Impact": "Low",
|
||
"Public": "20231218"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315001",
|
||
"Comment": "openssh-askpass-common-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315002",
|
||
"Comment": "openssh-clients-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315003",
|
||
"Comment": "openssh-common-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315004",
|
||
"Comment": "openssh-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315005",
|
||
"Comment": "openssh-keysign-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315006",
|
||
"Comment": "openssh-server-control-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20247315007",
|
||
"Comment": "openssh-server-gostcrypto is earlier than 0:7.9p1-alt4.gost.p10.2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |