vuln-list-alt/oval/c9f2/ALT-PU-2021-2854/definitions.json
2024-04-16 14:26:14 +00:00

124 lines
4.6 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20212854",
"Version": "oval:org.altlinux.errata:def:20212854",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2021-2854: package `polkit` update to version 0.116-alt2.M90P.3",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c9f2"
],
"Products": [
"ALT SPWorkstation",
"ALT SPServer"
]
}
],
"References": [
{
"RefID": "ALT-PU-2021-2854",
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-2854",
"Source": "ALTPU"
},
{
"RefID": "BDU:2021-03207",
"RefURL": "https://bdu.fstec.ru/vul/2021-03207",
"Source": "BDU"
},
{
"RefID": "CVE-2021-3560",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3560",
"Source": "CVE"
}
],
"Description": "This update upgrades polkit to version 0.116-alt2.M90P.3. \nSecurity Fix(es):\n\n * BDU:2021-03207: Уязвимость функции polkit_system_bus_name_get_creds_sync() демона dbus-daemon библиотеки Polkit, позволяющая нарушителю повысить свои привилегии\n\n * CVE-2021-3560: It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.\n\n * #39420: Polkit не проверяет список групп пользователя, назначенныx через NSS.",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2021-09-22"
},
"Updated": {
"Date": "2021-09-22"
},
"BDUs": [
{
"ID": "BDU:2021-03207",
"CVSS": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-863",
"Href": "https://bdu.fstec.ru/vul/2021-03207",
"Impact": "High",
"Public": "20210603"
}
],
"CVEs": [
{
"ID": "CVE-2021-3560",
"CVSS": "AV:L/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-754",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3560",
"Impact": "High",
"Public": "20220216"
}
],
"Bugzilla": [
{
"ID": "39420",
"Href": "https://bugzilla.altlinux.org/39420",
"Data": "Polkit не проверяет список групп пользователя, назначенныx через NSS."
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:8.4",
"cpe:/o:alt:spserver:8.4"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:3001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20212854001",
"Comment": "libpolkit is earlier than 0:0.116-alt2.M90P.3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212854002",
"Comment": "libpolkit-devel is earlier than 0:0.116-alt2.M90P.3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212854003",
"Comment": "libpolkit-gir is earlier than 0:0.116-alt2.M90P.3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212854004",
"Comment": "libpolkit-gir-devel is earlier than 0:0.116-alt2.M90P.3"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212854005",
"Comment": "polkit is earlier than 0:0.116-alt2.M90P.3"
}
]
}
]
}
}
]
}