pepelyaevip/vuln-list-alt
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
vuln-list-alt/oval/c9f2/ALT-PU-2021-2339/definitions.json
pepelyaevip 9d72b75f75 ALT Vulnerability
2024-12-12 21:07:30 +00:00

357 lines
16 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20212339",
"Version": "oval:org.altlinux.errata:def:20212339",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2021-2339: package `apache2` update to version 2.4.48-alt3.1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch c9f2"
],
"Products": [
"ALT SPWorkstation",
"ALT SPServer"
]
}
],
"References": [
{
"RefID": "ALT-PU-2021-2339",
"RefURL": "https://errata.altlinux.org/ALT-PU-2021-2339",
"Source": "ALTPU"
},
{
"RefID": "BDU:2021-03678",
"RefURL": "https://bdu.fstec.ru/vul/2021-03678",
"Source": "BDU"
},
{
"RefID": "BDU:2021-03679",
"RefURL": "https://bdu.fstec.ru/vul/2021-03679",
"Source": "BDU"
},
{
"RefID": "BDU:2021-03680",
"RefURL": "https://bdu.fstec.ru/vul/2021-03680",
"Source": "BDU"
},
{
"RefID": "BDU:2021-03681",
"RefURL": "https://bdu.fstec.ru/vul/2021-03681",
"Source": "BDU"
},
{
"RefID": "BDU:2021-06310",
"RefURL": "https://bdu.fstec.ru/vul/2021-06310",
"Source": "BDU"
},
{
"RefID": "BDU:2022-00270",
"RefURL": "https://bdu.fstec.ru/vul/2022-00270",
"Source": "BDU"
},
{
"RefID": "CVE-2019-17567",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-17567",
"Source": "CVE"
},
{
"RefID": "CVE-2020-13950",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-13950",
"Source": "CVE"
},
{
"RefID": "CVE-2020-35452",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2020-35452",
"Source": "CVE"
},
{
"RefID": "CVE-2021-26690",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-26690",
"Source": "CVE"
},
{
"RefID": "CVE-2021-26691",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-26691",
"Source": "CVE"
},
{
"RefID": "CVE-2021-30641",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2021-30641",
"Source": "CVE"
}
],
"Description": "This update upgrades apache2 to version 2.4.48-alt3.1. \nSecurity Fix(es):\n\n * BDU:2021-03678: Уязвимость веб-сервера Apache HTTP Server, связанная с переполнением кучи, позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2021-03679: Уязвимость функции mod_auth_digest веб-сервера Apache HTTP Server , позволяющая нарушителю оказать воздействие на конфиденциальность, целостность и доступность защищаемой информации\n\n * BDU:2021-03680: Уязвимость веб-сервера Apache HTTP Server, существующая из-за недостаточной проверки входных данных, позволяющая нарушителю оказать воздействие на целостность защищаемой информации\n\n * BDU:2021-03681: Уязвимость веб-сервера Apache HTTP Server, связанная с ошибками разыменования указателей, позволяющая нарушителю вызвать аварийное завершение работы приложения\n\n * BDU:2021-06310: Уязвимость функции mod_proxy_http веб-сервера Apache HTTP Server, связанная с ошибками разыменования указателя, позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2022-00270: Уязвимость свободного веб-сервера apache2, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю оказать воздействие на целостность данных\n\n * CVE-2019-17567: Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP validation, authentication or authorization possibly configured.\n\n * CVE-2020-13950: Apache HTTP Server versions 2.4.41 to 2.4.46 mod_proxy_http can be made to crash (NULL pointer dereference) with specially crafted requests using both Content-Length and Transfer-Encoding headers, leading to a Denial of Service\n\n * CVE-2020-35452: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. There is no report of this overflow being exploitable, nor the Apache HTTP Server team could create one, though some particular compiler and/or compilation option might make it possible, with limited consequences anyway due to the size (a single byte) and the value (zero byte) of the overflow\n\n * CVE-2021-26690: Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service\n\n * CVE-2021-26691: In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow\n\n * CVE-2021-30641: Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "Critical",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2021-07-26"
},
"Updated": {
"Date": "2021-07-26"
},
"BDUs": [
{
"ID": "BDU:2021-03678",
"CVSS": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-122, CWE-787",
"Href": "https://bdu.fstec.ru/vul/2021-03678",
"Impact": "Critical",
"Public": "20210301"
},
{
"ID": "BDU:2021-03679",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"CWE": "CWE-787",
"Href": "https://bdu.fstec.ru/vul/2021-03679",
"Impact": "High",
"Public": "20201111"
},
{
"ID": "BDU:2021-03680",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CWE": "CWE-20",
"Href": "https://bdu.fstec.ru/vul/2021-03680",
"Impact": "Low",
"Public": "20210414"
},
{
"ID": "BDU:2021-03681",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2021-03681",
"Impact": "High",
"Public": "20210208"
},
{
"ID": "BDU:2021-06310",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:C",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://bdu.fstec.ru/vul/2021-06310",
"Impact": "High",
"Public": "20210610"
},
{
"ID": "BDU:2022-00270",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"CVSS3": "AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CWE": "CWE-444",
"Href": "https://bdu.fstec.ru/vul/2022-00270",
"Impact": "Low",
"Public": "20210610"
}
],
"CVEs": [
{
"ID": "CVE-2019-17567",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CWE": "CWE-444",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-17567",
"Impact": "Low",
"Public": "20210610"
},
{
"ID": "CVE-2020-13950",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-13950",
"Impact": "High",
"Public": "20210610"
},
{
"ID": "CVE-2020-35452",
"CVSS": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2020-35452",
"Impact": "High",
"Public": "20210610"
},
{
"ID": "CVE-2021-26690",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"CWE": "CWE-476",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-26690",
"Impact": "High",
"Public": "20210610"
},
{
"ID": "CVE-2021-26691",
"CVSS": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-787",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-26691",
"Impact": "Critical",
"Public": "20210610"
},
{
"ID": "CVE-2021-30641",
"CVSS": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"CWE": "NVD-CWE-Other",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2021-30641",
"Impact": "Low",
"Public": "20210610"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:spworkstation:8.4",
"cpe:/o:alt:spserver:8.4"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:4001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20212339001",
"Comment": "apache2 is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339002",
"Comment": "apache2-ab is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339003",
"Comment": "apache2-base is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339004",
"Comment": "apache2-cgi-bin is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339005",
"Comment": "apache2-cgi-bin-printenv is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339006",
"Comment": "apache2-cgi-bin-test-cgi is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339007",
"Comment": "apache2-compat is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339008",
"Comment": "apache2-configs-A1PROXIED is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339009",
"Comment": "apache2-datadirs is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339010",
"Comment": "apache2-devel is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339011",
"Comment": "apache2-docs is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339012",
"Comment": "apache2-full is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339013",
"Comment": "apache2-htcacheclean is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339014",
"Comment": "apache2-htcacheclean-control is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339015",
"Comment": "apache2-html is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339016",
"Comment": "apache2-htpasswd is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339017",
"Comment": "apache2-httpd-event is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339018",
"Comment": "apache2-httpd-prefork is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339019",
"Comment": "apache2-httpd-worker is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339020",
"Comment": "apache2-icons is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339021",
"Comment": "apache2-manual is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339022",
"Comment": "apache2-manual-addons is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339023",
"Comment": "apache2-mod_cache_disk is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339024",
"Comment": "apache2-mod_ldap is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339025",
"Comment": "apache2-mod_proxy_html is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339026",
"Comment": "apache2-mod_ssl is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339027",
"Comment": "apache2-mod_ssl-compat is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339028",
"Comment": "apache2-mods is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339029",
"Comment": "apache2-suexec is earlier than 1:2.4.48-alt3.1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20212339030",
"Comment": "rpm-build-apache2 is earlier than 1:2.4.48-alt3.1"
}
]
}
]
}
}
]
}
Reference in New Issue View Git Blame Copy Permalink