vuln-list-alt/oval/c9f2/ALT-PU-2014-1992/definitions.json

{
  "Definition": [
    {
      "ID": "oval:org.altlinux.errata:def:20141992",
      "Version": "oval:org.altlinux.errata:def:20141992",
      "Class": "patch",
      "Metadata": {
        "Title": "ALT-PU-2014-1992: package `libgcrypt` update to version 1.5.4-alt1",
        "AffectedList": [
          {
            "Family": "unix",
            "Platforms": [
              "ALT Linux branch c9f2"
            ],
            "Products": [
              "ALT SPWorkstation",
              "ALT SPServer"
            ]
          }
        ],
        "References": [
          {
            "RefID": "ALT-PU-2014-1992",
            "RefURL": "https://errata.altlinux.org/ALT-PU-2014-1992",
            "Source": "ALTPU"
          },
          {
            "RefID": "BDU:2015-09792",
            "RefURL": "https://bdu.fstec.ru/vul/2015-09792",
            "Source": "BDU"
          },
          {
            "RefID": "BDU:2019-01635",
            "RefURL": "https://bdu.fstec.ru/vul/2019-01635",
            "Source": "BDU"
          },
          {
            "RefID": "CVE-2014-5270",
            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2014-5270",
            "Source": "CVE"
          },
          {
            "RefID": "CVE-2016-6313",
            "RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2016-6313",
            "Source": "CVE"
          }
        ],
        "Description": "This update upgrades libgcrypt to version 1.5.4-alt1. \nSecurity Fix(es):\n\n * BDU:2015-09792: Уязвимость операционной системы Gentoo Linux, позволяющая злоумышленнику нарушить конфиденциальность защищаемой информации\n\n * BDU:2019-01635: Уязвимость генератора псевдослучайных чисел библиотеки криптографии Libgcrypt, связанная с раскрытием информации, позволяющая нарушителю прогнозировать выходные данные\n\n * CVE-2014-5270: Libgcrypt before 1.5.4, as used in GnuPG and other products, does not properly perform ciphertext normalization and ciphertext randomization, which makes it easier for physically proximate attackers to conduct key-extraction attacks by leveraging the ability to collect voltage data from exposed metal, a different vector than CVE-2013-4576.\n\n * CVE-2016-6313: The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1.4.21 make it easier for attackers to obtain the values of 160 bits by leveraging knowledge of the previous 4640 bits.",
        "Advisory": {
          "From": "errata.altlinux.org",
          "Severity": "Low",
          "Rights": "Copyright 2024 BaseALT Ltd.",
          "Issued": {
            "Date": "2014-08-11"
          },
          "Updated": {
            "Date": "2014-08-11"
          },
          "BDUs": [
            {
              "ID": "BDU:2015-09792",
              "CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
              "CWE": "CWE-200",
              "Href": "https://bdu.fstec.ru/vul/2015-09792",
              "Impact": "Low",
              "Public": "20140829"
            },
            {
              "ID": "BDU:2019-01635",
              "CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "CWE": "CWE-200",
              "Href": "https://bdu.fstec.ru/vul/2019-01635",
              "Impact": "Low",
              "Public": "20160817"
            }
          ],
          "CVEs": [
            {
              "ID": "CVE-2014-5270",
              "CVSS": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
              "CWE": "CWE-200",
              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2014-5270",
              "Impact": "Low",
              "Public": "20141010"
            },
            {
              "ID": "CVE-2016-6313",
              "CVSS": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
              "CVSS3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
              "CWE": "CWE-200",
              "Href": "https://nvd.nist.gov/vuln/detail/CVE-2016-6313",
              "Impact": "Low",
              "Public": "20161213"
            }
          ],
          "AffectedCPEs": {
            "CPEs": [
              "cpe:/o:alt:spworkstation:8.4",
              "cpe:/o:alt:spserver:8.4"
            ]
          }
        }
      },
      "Criteria": {
        "Operator": "AND",
        "Criterions": [
          {
            "TestRef": "oval:org.altlinux.errata:tst:4001",
            "Comment": "ALT Linux must be installed"
          }
        ],
        "Criterias": [
          {
            "Operator": "OR",
            "Criterions": [
              {
                "TestRef": "oval:org.altlinux.errata:tst:20141992001",
                "Comment": "libgcrypt is earlier than 0:1.5.4-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20141992002",
                "Comment": "libgcrypt-common is earlier than 0:1.5.4-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20141992003",
                "Comment": "libgcrypt-devel is earlier than 0:1.5.4-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20141992004",
                "Comment": "libgcrypt-devel-static is earlier than 0:1.5.4-alt1"
              },
              {
                "TestRef": "oval:org.altlinux.errata:tst:20141992005",
                "Comment": "libgcrypt-utils is earlier than 0:1.5.4-alt1"
              }
            ]
          }
        ]
      }
    }
  ]
}