145 lines
6.0 KiB
JSON
145 lines
6.0 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20222971",
|
||
"Version": "oval:org.altlinux.errata:def:20222971",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2022-2971: package `389-ds-base` update to version 2.2.3-alt2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2022-2971",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2022-2971",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2022-04434",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2022-04434",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2023-02651",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2023-02651",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2021-3652",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-3652",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2022-1949",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2022-1949",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades 389-ds-base to version 2.2.3-alt2. \nSecurity Fix(es):\n\n * BDU:2022-04434: Уязвимость фильтра поиска (ldbm_search.c) сервера службы каталогов 389 Directory Server, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2023-02651: Уязвимость сервера службы каталогов 389 Directory Server, связанная с недостатками процедуры аутентификации, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность\n\n * CVE-2021-3652: A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being inactive, any password will successfully match during authentication. This flaw allows an attacker to successfully authenticate as a user whose password was disabled.\n\n * CVE-2022-1949: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2022-11-01"
|
||
},
|
||
"Updated": {
|
||
"Date": "2022-11-01"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2022-04434",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-284, CWE-863",
|
||
"Href": "https://bdu.fstec.ru/vul/2022-04434",
|
||
"Impact": "High",
|
||
"Public": "20220222"
|
||
},
|
||
{
|
||
"ID": "BDU:2023-02651",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||
"CWE": "CWE-287",
|
||
"Href": "https://bdu.fstec.ru/vul/2023-02651",
|
||
"Impact": "Low",
|
||
"Public": "20210629"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2021-3652",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
|
||
"CWE": "NVD-CWE-Other",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-3652",
|
||
"Impact": "Low",
|
||
"Public": "20220418"
|
||
},
|
||
{
|
||
"ID": "CVE-2022-1949",
|
||
"CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
|
||
"CWE": "CWE-639",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2022-1949",
|
||
"Impact": "High",
|
||
"Public": "20220602"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20222971001",
|
||
"Comment": "389-ds-base is earlier than 0:2.2.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20222971002",
|
||
"Comment": "389-ds-base-devel is earlier than 0:2.2.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20222971003",
|
||
"Comment": "389-ds-base-libs is earlier than 0:2.2.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20222971004",
|
||
"Comment": "cockpit-389-ds is earlier than 0:2.2.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20222971005",
|
||
"Comment": "python3-module-lib389 is earlier than 0:2.2.3-alt2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |