515 lines
27 KiB
JSON
515 lines
27 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20211982",
|
||
"Version": "oval:org.altlinux.errata:def:20211982",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2021-1982: package `salt` update to version 3003-alt2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p9"
|
||
],
|
||
"Products": [
|
||
"ALT Server",
|
||
"ALT Virtualization Server",
|
||
"ALT Workstation",
|
||
"ALT Workstation K",
|
||
"ALT Education",
|
||
"Simply Linux",
|
||
"Starterkit"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2021-1982",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-1982",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01180",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01180",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01592",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01592",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01900",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01900",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01902",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01902",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-01903",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-01903",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-05977",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-05977",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06340",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06340",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06341",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06341",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06345",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06345",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2021-06348",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2021-06348",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-00038",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-00038",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-00655",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-00655",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-07041",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-07041",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-07060",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-07060",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-16846",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-16846",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-17490",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-17490",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-25592",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-25592",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-28243",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-28243",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-28972",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-28972",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2020-35662",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-35662",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25281",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25281",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25282",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25282",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25283",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25283",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25284",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25284",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-25315",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-25315",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3144",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3144",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3148",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3148",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-31607",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-31607",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3197",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3197",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades salt to version 3003-alt2. \nSecurity Fix(es):\n\n * BDU:2021-01180: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю выполнить атаку типа «человек посередине»\n\n * BDU:2021-01592: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с неправильной реализацией алгоритма аутентификации, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2021-01900: Уязвимость компонента salt-netapi системы управления конфигурациями и удалённого выполнения операций Salt, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2021-01902: Уязвимость модуля TLS системы управления конфигурациями и удалённого выполнения операций Salt, связанная с неправильным присвоением разрешений для критичного ресурса, позволяющая нарушителю получить доступ к конфиденциальным данным\n\n * BDU:2021-01903: Уязвимость системы управления конфигурациями и удалённого выполнения операций Salt, связанная с отсутствием мер по нейтрализации специальных элементов, позволяющая нарушителю получить доступ к конфиденциальным данным, нарушить их целостность, а также вызвать отказ в обслуживании\n\n * BDU:2021-05977: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с неправильным ограничением доступа, позволяющая нарушителю получить несанкционированный доступ к другим ограниченным функциям\n\n * BDU:2021-06340: Уязвимость функции salt.utils.thin.gen_thin() системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю выполнять произвольные команды в целевой системе\n\n * BDU:2021-06341: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю локально повысить привилегии.\n\n * BDU:2021-06345: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю выполнять произвольные команды с повышенными привилегиями\n\n * BDU:2021-06348: Уязвимость компонента wheel.pillar_roots.write системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками при проверке вводимых данных, позволяющая нарушителю выполнить произвольный код\n\n * BDU:2022-00038: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками при обработке запросов аутентификации для истекших токенов eauth, позволяющая нарушителю выполнить произвольные команды\n\n * BDU:2022-00655: Уязвимость модуля snapper системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю повысить свои привилегии\n\n * BDU:2022-07041: Уязвимость системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю выполнить атаку типа «человек посередине»\n\n * BDU:2022-07060: Уязвимость реализации метода salt.wheel.pillar_roots.write системы управления конфигурациями и удалённого выполнения операций SaltStack Salt, позволяющая нарушителю раскрыть защищаемую информацию\n\n * CVE-2020-16846: An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.\n\n * CVE-2020-17490: The TLS module within SaltStack Salt through 3002 creates certificates with weak file permissions.\n\n * CVE-2020-25592: In SaltStack Salt through 3002, salt-netapi improperly validates eauth credentials and tokens. A user can bypass authentication and invoke Salt SSH.\n\n * CVE-2020-28243: An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.\n\n * CVE-2020-28972: In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validate the SSL/TLS certificate.\n\n * CVE-2020-35662: In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.\n\n * CVE-2021-25281: An issue was discovered in through SaltStack Salt before 3002.5. salt-api does not honor eauth credentials for the wheel_async client. Thus, an attacker can remotely run any wheel modules on the master.\n\n * CVE-2021-25282: An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal.\n\n * CVE-2021-25283: An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks.\n\n * CVE-2021-25284: An issue was discovered in through SaltStack Salt before 3002.5. salt.modules.cmdmod can log credentials to the info or error log level.\n\n * CVE-2021-25315: CWE - CWE-287: Improper Authentication vulnerability in SUSE Linux Enterprise Server 15 SP 3; openSUSE Tumbleweed allows local attackers to execute arbitrary code via salt without the need to specify valid credentials. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions. This issue affects: SUSE Linux Enterprise Server 15 SP 3 salt versions prior to 3002.2-3. openSUSE Tumbleweed salt version 3002.2-2.1 and prior versions.\n\n * CVE-2021-3144: In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration. (They might be used to run command against the salt master or minions.)\n\n * CVE-2021-3148: An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py.\n\n * CVE-2021-31607: In SaltStack Salt 2016.9 through 3002.6, a command injection vulnerability exists in the snapper module that allows for local privilege escalation on a minion. The attack requires that a file is created with a pathname that is backed up by snapper, and that the master calls the snapper.diff function (which executes popen unsafely).\n\n * CVE-2021-3197: An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Critical",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2021-06-11"
|
||
},
|
||
"Updated": {
|
||
"Date": "2021-06-11"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2021-01180",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01180",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01592",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
|
||
"CWE": "CWE-303",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01592",
|
||
"Impact": "Low",
|
||
"Public": "20210217"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01900",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01900",
|
||
"Impact": "Critical",
|
||
"Public": "20200915"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01902",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-732",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01902",
|
||
"Impact": "Low",
|
||
"Public": "20200811"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-01903",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-01903",
|
||
"Impact": "Critical",
|
||
"Public": "20201102"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-05977",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-05977",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06340",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06340",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06341",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06341",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06345",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06345",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2021-06348",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-94",
|
||
"Href": "https://bdu.fstec.ru/vul/2021-06348",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-00038",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-613",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-00038",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-00655",
|
||
"CVSS": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-00655",
|
||
"Impact": "High",
|
||
"Public": "20210423"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-07041",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:C/A:N",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-07041",
|
||
"Impact": "High",
|
||
"Public": "20210225"
|
||
},
|
||
{
|
||
"ID": "BDU:2022-07060",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-07060",
|
||
"Impact": "Critical",
|
||
"Public": "20210225"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2020-16846",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-16846",
|
||
"Impact": "Critical",
|
||
"Public": "20201106"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-17490",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-732",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-17490",
|
||
"Impact": "Low",
|
||
"Public": "20201106"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-25592",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-25592",
|
||
"Impact": "Critical",
|
||
"Public": "20201106"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-28243",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-28243",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-28972",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-28972",
|
||
"Impact": "Low",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2020-35662",
|
||
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-295",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-35662",
|
||
"Impact": "High",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25281",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25281",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25282",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
|
||
"CWE": "CWE-22",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25282",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25283",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-94",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25283",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25284",
|
||
"CVSS": "AV:L/AC:M/Au:N/C:N/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
|
||
"CWE": "CWE-532",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25284",
|
||
"Impact": "Low",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-25315",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-25315",
|
||
"Impact": "High",
|
||
"Public": "20210303"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3144",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
|
||
"CWE": "CWE-613",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3144",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3148",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-77",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3148",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-31607",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-78",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-31607",
|
||
"Impact": "High",
|
||
"Public": "20210423"
|
||
},
|
||
{
|
||
"ID": "CVE-2021-3197",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-74",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3197",
|
||
"Impact": "Critical",
|
||
"Public": "20210227"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:kworkstation:9",
|
||
"cpe:/o:alt:workstation:9",
|
||
"cpe:/o:alt:server:9",
|
||
"cpe:/o:alt:server-v:9",
|
||
"cpe:/o:alt:education:9",
|
||
"cpe:/o:alt:slinux:9",
|
||
"cpe:/o:alt:starterkit:p9",
|
||
"cpe:/o:alt:kworkstation:9.1",
|
||
"cpe:/o:alt:workstation:9.1",
|
||
"cpe:/o:alt:server:9.1",
|
||
"cpe:/o:alt:server-v:9.1",
|
||
"cpe:/o:alt:education:9.1",
|
||
"cpe:/o:alt:slinux:9.1",
|
||
"cpe:/o:alt:starterkit:9.1",
|
||
"cpe:/o:alt:kworkstation:9.2",
|
||
"cpe:/o:alt:workstation:9.2",
|
||
"cpe:/o:alt:server:9.2",
|
||
"cpe:/o:alt:server-v:9.2",
|
||
"cpe:/o:alt:education:9.2",
|
||
"cpe:/o:alt:slinux:9.2",
|
||
"cpe:/o:alt:starterkit:9.2"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:1001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211982001",
|
||
"Comment": "python3-module-salt is earlier than 0:3003-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211982002",
|
||
"Comment": "salt-api is earlier than 0:3003-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211982003",
|
||
"Comment": "salt-master is earlier than 0:3003-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20211982004",
|
||
"Comment": "salt-minion is earlier than 0:3003-alt2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |