106 lines
3.8 KiB
JSON
106 lines
3.8 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20246191",
|
||
"Version": "oval:org.altlinux.errata:def:20246191",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2024-6191: package `libnghttp2` update to version 1.61.0-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c9f2"
|
||
],
|
||
"Products": [
|
||
"ALT SPWorkstation",
|
||
"ALT SPServer"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2024-6191",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-6191",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-02691",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-02691",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-28182",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-28182",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades libnghttp2 to version 1.61.0-alt1. \nSecurity Fix(es):\n\n * BDU:2024-02691: Уязвимость библиотеки nghttp2, связанная с неограниченным распределением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2024-28182: nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C. The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. There is no workaround for this vulnerability.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Low",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-04-10"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-04-10"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2024-02691",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||
"CWE": "CWE-770",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-02691",
|
||
"Impact": "Low",
|
||
"Public": "20240404"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2024-28182",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-28182",
|
||
"Impact": "None",
|
||
"Public": "20240404"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:8.4",
|
||
"cpe:/o:alt:spserver:8.4"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20246191001",
|
||
"Comment": "libnghttp2 is earlier than 0:1.61.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20246191002",
|
||
"Comment": "libnghttp2-devel is earlier than 0:1.61.0-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20246191003",
|
||
"Comment": "libnghttp2-tools is earlier than 0:1.61.0-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |