251 lines
13 KiB
JSON
251 lines
13 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:202414497",
|
||
"Version": "oval:org.altlinux.errata:def:202414497",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2024-14497: package `python3` update to version 3.9.20-alt0.c10f1.1",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch c10f1"
|
||
],
|
||
"Products": [
|
||
"ALT SP Workstation",
|
||
"ALT SP Server"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2024-14497",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2024-14497",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-04927",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-04927",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-05177",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-05177",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-05196",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-05196",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "BDU:2024-06863",
|
||
"RefURL": "https://bdu.fstec.ru/vul/2024-06863",
|
||
"Source": "BDU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-0397",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-0450",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-0450",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-3219",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-3219",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-4032",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-4032",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-5642",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-5642",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-6923",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-6923",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-7592",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592",
|
||
"Source": "CVE"
|
||
},
|
||
{
|
||
"RefID": "CVE-2024-8088",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2024-8088",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades python3 to version 3.9.20-alt0.c10f1.1. \nSecurity Fix(es):\n\n * BDU:2024-04927: Уязвимость модуля zipfile интерпретатора языка программирования Python (CPython), позволяющая нарушителю вызвать отказ в обслуживании\n\n * BDU:2024-05177: Уязвимость функций cert_store_stats() и get_ca_certs() модуля ssl интерпретатора языка программирования Python (CPython), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-05196: Уязвимость классов ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address и ipaddress.IPv6Network модуля ipaddress интерпретатора языка программирования Python (CPython), позволяющая нарушителю получить несанкционированный доступ к защищаемой информации\n\n * BDU:2024-06863: Уязвимость модуля zipfile интерпретатора языка программирования Python, позволяющая нарушителю вызвать отказ в обслуживании\n\n * CVE-2024-0397: A defect was discovered in the Python “ssl” module where there is a memory\nrace condition with the ssl.SSLContext methods “cert_store_stats()” and\n“get_ca_certs()”. The race condition can be triggered if the methods are\ncalled at the same time as certificates are loaded into the SSLContext,\nsuch as during the TLS handshake with a certificate directory configured.\nThis issue is fixed in CPython 3.10.14, 3.11.9, 3.12.3, and 3.13.0a5.\n\n * CVE-2024-0450: An issue was found in the CPython `zipfile` module affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and prior.\n\nThe zipfile module is vulnerable to “quoted-overlap” zip-bombs which exploit the zip format to create a zip-bomb with a high compression ratio. The fixed versions of CPython makes the zipfile module reject zip archives which overlap entries in the archive.\n\n\n\n * CVE-2024-3219: The\n “socket” module provides a pure-Python fallback to the \nsocket.socketpair() function for platforms that don’t support AF_UNIX, \nsuch as Windows. This pure-Python implementation uses AF_INET or \nAF_INET6 to create a local connected pair of sockets. The connection \nbetween the two sockets was not verified before passing the two sockets \nback to the user, which leaves the server socket vulnerable to a \nconnection race from a malicious local peer.\n\nPlatforms that support AF_UNIX such as Linux and macOS are not affected by this vulnerability. Versions prior to CPython 3.5 are not affected due to the vulnerable API not being included.\n\n * CVE-2024-4032: The “ipaddress” module contained incorrect information about whether certain IPv4 and IPv6 addresses were designated as “globally reachable” or “private”. This affected the is_private and is_global properties of the ipaddress.IPv4Address, ipaddress.IPv4Network, ipaddress.IPv6Address, and ipaddress.IPv6Network classes, where values wouldn’t be returned in accordance with the latest information from the IANA Special-Purpose Address Registries.\n\nCPython 3.12.4 and 3.13.0a6 contain updated information from these registries and thus have the intended behavior.\n\n * CVE-2024-5642: CPython 3.9 and earlier doesn't disallow configuring an empty list (\"[]\") for SSLContext.set_npn_protocols() which is an invalid value for the underlying OpenSSL API. This results in a buffer over-read when NPN is used (see CVE-2024-5535 for OpenSSL). This vulnerability is of low severity due to NPN being not widely used and specifying an empty list likely being uncommon in-practice (typically a protocol name would be configured).\n\n * CVE-2024-6923: There is a MEDIUM severity vulnerability affecting CPython.\n\nThe \nemail module didn’t properly quote newlines for email headers when \nserializing an email message allowing for header injection when an email\n is serialized.\n\n * CVE-2024-7592: There is a LOW severity vulnerability affecting CPython, specifically the\n'http.cookies' standard library module.\n\n\nWhen parsing cookies that contained backslashes for quoted characters in\nthe cookie value, the parser would use an algorithm with quadratic\ncomplexity, resulting in excess CPU resources being used while parsing the\nvalue.\n\n * CVE-2024-8088: There is a HIGH severity vulnerability affecting the CPython \"zipfile\"\nmodule affecting \"zipfile.Path\". Note that the more common API \"zipfile.ZipFile\" class is unaffected.\n\n\n\n\n\nWhen iterating over names of entries in a zip archive (for example, methods\nof \"zipfile.Path\" like \"namelist()\", \"iterdir()\", etc)\nthe process can be put into an infinite loop with a maliciously crafted\nzip archive. This defect applies when reading only metadata or extracting\nthe contents of the zip archive. Programs that are not handling\nuser-controlled zip archives are not affected.",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "High",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2024-10-29"
|
||
},
|
||
"Updated": {
|
||
"Date": "2024-10-29"
|
||
},
|
||
"BDUs": [
|
||
{
|
||
"ID": "BDU:2024-04927",
|
||
"CVSS": "AV:L/AC:L/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-400, CWE-404, CWE-405",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-04927",
|
||
"Impact": "Low",
|
||
"Public": "20230925"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-05177",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:C/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H",
|
||
"CWE": "CWE-362",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-05177",
|
||
"Impact": "High",
|
||
"Public": "20240110"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-05196",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:N/I:N/A:P",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
|
||
"CWE": "CWE-20",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-05196",
|
||
"Impact": "Low",
|
||
"Public": "20231215"
|
||
},
|
||
{
|
||
"ID": "BDU:2024-06863",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:N/I:N/A:C",
|
||
"CVSS3": "AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-835",
|
||
"Href": "https://bdu.fstec.ru/vul/2024-06863",
|
||
"Impact": "Low",
|
||
"Public": "20240822"
|
||
}
|
||
],
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2024-0397",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-0397",
|
||
"Impact": "None",
|
||
"Public": "20240617"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-0450",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-0450",
|
||
"Impact": "None",
|
||
"Public": "20240319"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-3219",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-3219",
|
||
"Impact": "None",
|
||
"Public": "20240729"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-4032",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-4032",
|
||
"Impact": "None",
|
||
"Public": "20240617"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-5642",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-5642",
|
||
"Impact": "None",
|
||
"Public": "20240627"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-6923",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-6923",
|
||
"Impact": "None",
|
||
"Public": "20240801"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-7592",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
|
||
"CWE": "CWE-1333",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-7592",
|
||
"Impact": "High",
|
||
"Public": "20240819"
|
||
},
|
||
{
|
||
"ID": "CVE-2024-8088",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2024-8088",
|
||
"Impact": "None",
|
||
"Public": "20240822"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:spworkstation:10",
|
||
"cpe:/o:alt:spserver:10"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:4001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497001",
|
||
"Comment": "libpython3 is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497002",
|
||
"Comment": "python3 is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497003",
|
||
"Comment": "python3-base is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497004",
|
||
"Comment": "python3-dev is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497005",
|
||
"Comment": "python3-modules-curses is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497006",
|
||
"Comment": "python3-modules-sqlite3 is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497007",
|
||
"Comment": "python3-modules-tkinter is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497008",
|
||
"Comment": "python3-test is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:202414497009",
|
||
"Comment": "python3-tools is earlier than 0:3.9.20-alt0.c10f1.1"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |