119 lines
4.1 KiB
JSON
119 lines
4.1 KiB
JSON
{
|
||
"Definition": [
|
||
{
|
||
"ID": "oval:org.altlinux.errata:def:20193152",
|
||
"Version": "oval:org.altlinux.errata:def:20193152",
|
||
"Class": "patch",
|
||
"Metadata": {
|
||
"Title": "ALT-PU-2019-3152: package `mbedtls` update to version 2.16.3-alt2",
|
||
"AffectedList": [
|
||
{
|
||
"Family": "unix",
|
||
"Platforms": [
|
||
"ALT Linux branch p9"
|
||
],
|
||
"Products": [
|
||
"ALT Server",
|
||
"ALT Virtualization Server",
|
||
"ALT Workstation",
|
||
"ALT Workstation K",
|
||
"ALT Education",
|
||
"Simply Linux",
|
||
"Starterkit"
|
||
]
|
||
}
|
||
],
|
||
"References": [
|
||
{
|
||
"RefID": "ALT-PU-2019-3152",
|
||
"RefURL": "https://errata.altlinux.org/ALT-PU-2019-3152",
|
||
"Source": "ALTPU"
|
||
},
|
||
{
|
||
"RefID": "CVE-2019-16910",
|
||
"RefURL": "https://nvd.nist.gov/vuln/detail/CVE-2019-16910",
|
||
"Source": "CVE"
|
||
}
|
||
],
|
||
"Description": "This update upgrades mbedtls to version 2.16.3-alt2. \nSecurity Fix(es):\n\n * CVE-2019-16910: Arm Mbed TLS before 2.19.0 and Arm Mbed Crypto before 2.0.0, when deterministic ECDSA is enabled, use an RNG with insufficient entropy for blinding, which might allow an attacker to recover a private key via side-channel attacks if a victim signs the same message many times. (For Mbed TLS, the fix is also available in versions 2.7.12 and 2.16.3.)\n\n * #37417: Конфликтует с hiawatha при обновлении с p8 до p9",
|
||
"Advisory": {
|
||
"From": "errata.altlinux.org",
|
||
"Severity": "Low",
|
||
"Rights": "Copyright 2024 BaseALT Ltd.",
|
||
"Issued": {
|
||
"Date": "2019-11-18"
|
||
},
|
||
"Updated": {
|
||
"Date": "2019-11-18"
|
||
},
|
||
"BDUs": null,
|
||
"CVEs": [
|
||
{
|
||
"ID": "CVE-2019-16910",
|
||
"CVSS": "AV:N/AC:H/Au:N/C:P/I:N/A:N",
|
||
"CVSS3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
|
||
"CWE": "NVD-CWE-noinfo",
|
||
"Href": "https://nvd.nist.gov/vuln/detail/CVE-2019-16910",
|
||
"Impact": "Low",
|
||
"Public": "20190926"
|
||
}
|
||
],
|
||
"Bugzilla": [
|
||
{
|
||
"ID": "37417",
|
||
"Href": "https://bugzilla.altlinux.org/37417",
|
||
"Data": "Конфликтует с hiawatha при обновлении с p8 до p9"
|
||
}
|
||
],
|
||
"AffectedCPEs": {
|
||
"CPEs": [
|
||
"cpe:/o:alt:kworkstation:9",
|
||
"cpe:/o:alt:workstation:9",
|
||
"cpe:/o:alt:server:9",
|
||
"cpe:/o:alt:server-v:9",
|
||
"cpe:/o:alt:education:9",
|
||
"cpe:/o:alt:slinux:9",
|
||
"cpe:/o:alt:starterkit:p9"
|
||
]
|
||
}
|
||
}
|
||
},
|
||
"Criteria": {
|
||
"Operator": "AND",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:1001",
|
||
"Comment": "ALT Linux must be installed"
|
||
}
|
||
],
|
||
"Criterias": [
|
||
{
|
||
"Operator": "OR",
|
||
"Criterions": [
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20193152001",
|
||
"Comment": "libmbedcrypto3 is earlier than 0:2.16.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20193152002",
|
||
"Comment": "libmbedtls-devel is earlier than 0:2.16.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20193152003",
|
||
"Comment": "libmbedtls12 is earlier than 0:2.16.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20193152004",
|
||
"Comment": "libmbedx509-0 is earlier than 0:2.16.3-alt2"
|
||
},
|
||
{
|
||
"TestRef": "oval:org.altlinux.errata:tst:20193152005",
|
||
"Comment": "mbedtls-utils is earlier than 0:2.16.3-alt2"
|
||
}
|
||
]
|
||
}
|
||
]
|
||
}
|
||
}
|
||
]
|
||
} |