2024-12-12 21:07:30 +00:00

122 lines
4.3 KiB
JSON
Raw Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

{
"Definition": [
{
"ID": "oval:org.altlinux.errata:def:20192943",
"Version": "oval:org.altlinux.errata:def:20192943",
"Class": "patch",
"Metadata": {
"Title": "ALT-PU-2019-2943: package `sudo` update to version 1.8.28-alt1",
"AffectedList": [
{
"Family": "unix",
"Platforms": [
"ALT Linux branch p9"
],
"Products": [
"ALT Server",
"ALT Virtualization Server",
"ALT Workstation",
"ALT Workstation K",
"ALT Education",
"Simply Linux",
"Starterkit"
]
}
],
"References": [
{
"RefID": "ALT-PU-2019-2943",
"RefURL": "https://errata.altlinux.org/ALT-PU-2019-2943",
"Source": "ALTPU"
},
{
"RefID": "BDU:2019-03696",
"RefURL": "https://bdu.fstec.ru/vul/2019-03696",
"Source": "BDU"
},
{
"RefID": "CVE-2019-14287",
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-14287",
"Source": "CVE"
}
],
"Description": "This update upgrades sudo to version 1.8.28-alt1. \nSecurity Fix(es):\n\n * BDU:2019-03696: Уязвимость программы системного администрирования Sudo, существующая из-за недостаточной проверки входных данных, выполнить произвольные команды с привилегиями root\n\n * CVE-2019-14287: In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. For example, this allows bypass of !root configuration, and USER= logging, for a \"sudo -u \\#$((0xffffffff))\" command.\n\n * #37334: CVE-2019-14287 в sudo \u003c 1.8.28",
"Advisory": {
"From": "errata.altlinux.org",
"Severity": "High",
"Rights": "Copyright 2024 BaseALT Ltd.",
"Issued": {
"Date": "2019-10-17"
},
"Updated": {
"Date": "2019-10-17"
},
"BDUs": [
{
"ID": "BDU:2019-03696",
"CVSS": "AV:L/AC:L/Au:S/C:C/I:C/A:C",
"CVSS3": "AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-267",
"Href": "https://bdu.fstec.ru/vul/2019-03696",
"Impact": "High",
"Public": "20191014"
}
],
"CVEs": [
{
"ID": "CVE-2019-14287",
"CVSS": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"CWE": "CWE-755",
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-14287",
"Impact": "High",
"Public": "20191017"
}
],
"Bugzilla": [
{
"ID": "37334",
"Href": "https://bugzilla.altlinux.org/37334",
"Data": "CVE-2019-14287 в sudo \u003c 1.8.28"
}
],
"AffectedCPEs": {
"CPEs": [
"cpe:/o:alt:kworkstation:9",
"cpe:/o:alt:workstation:9",
"cpe:/o:alt:server:9",
"cpe:/o:alt:server-v:9",
"cpe:/o:alt:education:9",
"cpe:/o:alt:slinux:9",
"cpe:/o:alt:starterkit:p9"
]
}
}
},
"Criteria": {
"Operator": "AND",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:1001",
"Comment": "ALT Linux must be installed"
}
],
"Criterias": [
{
"Operator": "OR",
"Criterions": [
{
"TestRef": "oval:org.altlinux.errata:tst:20192943001",
"Comment": "sudo is earlier than 1:1.8.28-alt1"
},
{
"TestRef": "oval:org.altlinux.errata:tst:20192943002",
"Comment": "sudo-devel is earlier than 1:1.8.28-alt1"
}
]
}
]
}
}
]
}