383 lines
17 KiB
JSON
383 lines
17 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20248851",
|
||
"Version": "oval:org.altlinux.errata:def:20248851",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2024-8851: package `moodle` update to version 4.3.5-alt1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p11"
|
||
],
|
||
"Products": [
|
||
"ALT Container"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2024-8851",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-8851",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-04201",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-04201",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-04202",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-04202",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6661",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6661",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6662",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6662",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6663",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6663",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6664",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6664",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6665",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6665",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6666",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6666",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6667",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6667",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6668",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6668",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6669",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6669",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2023-6670",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2023-6670",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-25978",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-25978",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-25979",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-25979",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-25980",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-25980",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-25981",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-25981",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-25982",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-25982",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-25983",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-25983",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-33996",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-33996",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-33997",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-33997",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-33998",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-33998",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-33999",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-33999",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34000",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34000",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34001",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34001",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34002",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34002",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34003",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34003",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34004",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34004",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34005",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34005",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34006",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34006",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34007",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34007",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34008",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34008",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-34009",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-34009",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades moodle to version 4.3.5-alt1. \nSecurity Fix(es):\n\n * BDU:2024-04201: Уязвимость виртуальной обучающей среды Moodle, связанная с непринятием мер по защите структуры веб-страницы позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)\n\n * BDU:2024-04202: Уязвимость виртуальной обучающей среды Moodle, связанная с непринятием мер по защите структуры веб-страницы позволяющая нарушителю провести атаку межсайтового скриптинга (XSS)\n\n * CVE-2023-6661: description unavailable\n\n * CVE-2023-6662: description unavailable\n\n * CVE-2023-6663: description unavailable\n\n * CVE-2023-6664: description unavailable\n\n * CVE-2023-6665: description unavailable\n\n * CVE-2023-6666: description unavailable\n\n * CVE-2023-6667: description unavailable\n\n * CVE-2023-6668: description unavailable\n\n * CVE-2023-6669: description unavailable\n\n * CVE-2023-6670: description unavailable\n\n * CVE-2024-25978: Insufficient file size checks resulted in a denial of service risk in the file picker's unzip functionality.\n\n * CVE-2024-25979: The URL parameters accepted by forum search were not limited to the allowed parameters.\n\n * CVE-2024-25980: Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.\n\n * CVE-2024-25981: Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.\n\n * CVE-2024-25982: The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.\n\n * CVE-2024-25983: Insufficient checks in a web service made it possible to add comments to the comments block on another user's dashboard when it was not otherwise available (e.g., on their profile page).\n\n * CVE-2024-33996: Incorrect validation of allowed event types in a calendar web service made it possible for some users to create events with types/audiences they did not have permission to publish to.\n\n * CVE-2024-33997: Additional sanitizing was required when opening the equation editor to prevent a stored XSS risk when editing another user's equation.\n\n * CVE-2024-33998: Insufficient escaping of participants' names in the participants page table resulted in a stored XSS risk when interacting with some features.\n\n * CVE-2024-33999: The referrer URL used by MFA required additional sanitizing, rather than being used directly.\n\n * CVE-2024-34000: ID numbers displayed in the lesson overview report required additional sanitizing to prevent a stored XSS risk.\n\n * CVE-2024-34001: Actions in the admin preset tool did not include the necessary token to prevent a CSRF risk.\n\n * CVE-2024-34002: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore feedback modules and direct access to the web server outside of the Moodle webroot could execute a local file include.\n\n * CVE-2024-34003: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore workshop modules and direct access to the web server outside of the Moodle webroot could execute a local file include.\n\n * CVE-2024-34004: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore wiki modules and direct access to the web server outside of the Moodle webroot could execute a local file include.\n\n * CVE-2024-34005: In a shared hosting environment that has been misconfigured to allow access to other users' content, a Moodle user with both access to restore database activity modules and direct access to the web server outside of the Moodle webroot could execute a local file include.\n\n * CVE-2024-34006: The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in plaintext instead of being rendered.\n\n * CVE-2024-34007: The logout option within MFA did not include the necessary token to avoid the risk of users inadvertently being logged out via CSRF.\n\n * CVE-2024-34008: Actions in the admin management of analytics models did not include the necessary token to prevent a CSRF risk.\n\n * CVE-2024-34009: Insufficient checks whether ReCAPTCHA was enabled made it possible to bypass the checks on the login page. This did not affect other pages where ReCAPTCHA is utilized.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-06-13"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-06-13"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2024-04201",
|
||
"CVSS": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-79",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-04201",
|
||
"Impact": "Low",
|
||
"Public": "20240222"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-04202",
|
||
"CVSS": "AV:N/AC:L/Au:S/C:C/I:N/A:N",
|
||
"CVSS3": "AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N",
|
||
"CWE": "CWE-79",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-04202",
|
||
"Impact": "Low",
|
||
"Public": "20240222"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2024-25978",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-25978",
|
||
"Impact": "None",
|
||
"Public": "20240219"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-25979",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-25979",
|
||
"Impact": "None",
|
||
"Public": "20240219"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-25980",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-25980",
|
||
"Impact": "None",
|
||
"Public": "20240219"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-25981",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-25981",
|
||
"Impact": "None",
|
||
"Public": "20240219"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-25982",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-25982",
|
||
"Impact": "None",
|
||
"Public": "20240219"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-25983",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-25983",
|
||
"Impact": "None",
|
||
"Public": "20240219"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-33996",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33996",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-33997",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33997",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-33998",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33998",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-33999",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-33999",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34000",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34000",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34001",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34001",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34002",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34002",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34003",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34003",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34004",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34004",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34005",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34005",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34006",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34006",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34007",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34007",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34008",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
|
||
"CWE": "CWE-352",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34008",
|
||
"Impact": "High",
|
||
"Public": "20240531"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-34009",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-34009",
|
||
"Impact": "None",
|
||
"Public": "20240531"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:container:11"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20248851001",
|
||
"Comment": "moodle is earlier than 0:4.3.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20248851002",
|
||
"Comment": "moodle-apache2 is earlier than 0:4.3.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20248851003",
|
||
"Comment": "moodle-base is earlier than 0:4.3.5-alt1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20248851004",
|
||
"Comment": "moodle-local-mysql is earlier than 0:4.3.5-alt1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |