100 lines
3.4 KiB
JSON
100 lines
3.4 KiB
JSON
{
|
|
"Definition": [
|
|
{
|
|
"ID": "oval:org.altlinux.errata:def:20182838",
|
|
"Version": "oval:org.altlinux.errata:def:20182838",
|
|
"Class": "patch",
|
|
"Metadata": {
|
|
"Title": "ALT-PU-2018-2838: package `grafana` update to version 5.4.2-alt1",
|
|
"AffectedList": [
|
|
{
|
|
"Family": "unix",
|
|
"Platforms": [
|
|
"ALT Linux branch c9f2"
|
|
],
|
|
"Products": [
|
|
"ALT SPWorkstation",
|
|
"ALT SPServer"
|
|
]
|
|
}
|
|
],
|
|
"References": [
|
|
{
|
|
"RefID": "ALT-PU-2018-2838",
|
|
"RefURL": "https://errata.altlinux.org/ALT-PU-2018-2838",
|
|
"Source": "ALTPU"
|
|
},
|
|
{
|
|
"RefID": "CVE-2018-1000816",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000816",
|
|
"Source": "CVE"
|
|
},
|
|
{
|
|
"RefID": "CVE-2018-19039",
|
|
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2018-19039",
|
|
"Source": "CVE"
|
|
}
|
|
],
|
|
"Description": "This update upgrades grafana to version 5.4.2-alt1. \nSecurity Fix(es):\n\n * CVE-2018-1000816: Grafana version confirmed for 5.2.4 and 5.3.0 contains a Cross Site Scripting (XSS) vulnerability in Influxdb and Graphite query editor that can result in Running arbitrary js code in victims browser.. This attack appear to be exploitable via Authenticated user must click on the input field where the payload was previously inserted..\n\n * CVE-2018-19039: Grafana before 4.6.5 and 5.x before 5.3.3 allows remote authenticated users to read arbitrary files by leveraging Editor or Admin permissions.",
|
|
"Advisory": {
|
|
"From": "errata.altlinux.org",
|
|
"Severity": "Low",
|
|
"Rights": "Copyright 2024 BaseALT Ltd.",
|
|
"Issued": {
|
|
"Date": "2018-12-13"
|
|
},
|
|
"Updated": {
|
|
"Date": "2018-12-13"
|
|
},
|
|
"BDUs": null,
|
|
"CVEs": [
|
|
{
|
|
"ID": "CVE-2018-1000816",
|
|
"CVSS": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
|
|
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
|
|
"CWE": "CWE-79",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-1000816",
|
|
"Impact": "Low",
|
|
"Public": "20181220"
|
|
},
|
|
{
|
|
"ID": "CVE-2018-19039",
|
|
"CVSS": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
|
|
"CVSS3": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
|
|
"CWE": "CWE-200",
|
|
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2018-19039",
|
|
"Impact": "Low",
|
|
"Public": "20181213"
|
|
}
|
|
],
|
|
"AffectedCPEs": {
|
|
"CPEs": [
|
|
"cpe:/o:alt:spworkstation:8.4",
|
|
"cpe:/o:alt:spserver:8.4"
|
|
]
|
|
}
|
|
}
|
|
},
|
|
"Criteria": {
|
|
"Operator": "AND",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:3001",
|
|
"Comment": "ALT Linux must be installed"
|
|
}
|
|
],
|
|
"Criterias": [
|
|
{
|
|
"Operator": "OR",
|
|
"Criterions": [
|
|
{
|
|
"TestRef": "oval:org.altlinux.errata:tst:20182838001",
|
|
"Comment": "grafana is earlier than 0:5.4.2-alt1"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
}
|
|
]
|
|
} |