149 lines
6.0 KiB
JSON
149 lines
6.0 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:202413457",
|
|
"Version": "oval:org.altlinux.errata:def:202413457",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2024-13457: package `python3` update to version 3.7.17-alt3",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2024-13457",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-13457",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "BDU:2023-04980",
|
|
"RefURL": "https://bdu.fstec.ru/vul/2023-04980",
|
|
"Source": "BDU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2023-27043",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-27043",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2024-7592",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades python3 to version 3.7.17-alt3. \nSecurity Fix(es):\n\n * BDU:2023-04980: Уязвимость модуля электронной почты интерпретатора языка программирования Python, позволяющая нарушителю обойти механизм защиты\n\n * CVE-2023-27043: The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.\n\n * CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "High",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2024-10-08"
|
|
},
|
|
"Updated": {
|
|
"Date": "2024-10-08"
|
|
},
|
|
"BDUs": [
|
|
{
|
|
"ID": "BDU:2023-04980",
|
|
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
|
|
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"CWE": "CWE-20",
|
|
"Href": "https://bdu.fstec.ru/vul/2023-04980",
|
|
"Impact": "Low",
|
|
"Public": "20230418"
|
|
}
|
|
],
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2023-27043",
|
|
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
|
|
"CWE": "CWE-20",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2023-27043",
|
|
"Impact": "Low",
|
|
"Public": "20230419"
|
|
},
|
|
{
|
|
"ID": "CVE-2024-7592",
|
|
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
|
"CWE": "CWE-1333",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592",
|
|
"Impact": "High",
|
|
"Public": "20240819"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457001",
|
|
"Comment": "libpython3 is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457002",
|
|
"Comment": "python3 is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457003",
|
|
"Comment": "python3-base is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457004",
|
|
"Comment": "python3-dev is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457005",
|
|
"Comment": "python3-modules-curses is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457006",
|
|
"Comment": "python3-modules-nis is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457007",
|
|
"Comment": "python3-modules-sqlite3 is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457008",
|
|
"Comment": "python3-modules-tkinter is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457009",
|
|
"Comment": "python3-test is earlier than 0:3.7.17-alt3"
|
|
},
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:202413457010",
|
|
"Comment": "python3-tools is earlier than 0:3.7.17-alt3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |