ALT-PU-2016-3279

Высокий

ALT-PU-2016-3279: package undertow update to version 1.4.0-alt1_1jpp8

Источник

errata.altlinux.org

Дата публикации

19.12.2016

Дата обновления

19.12.2016

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades undertow to version 1.4.0-alt1_1jpp8.

Устраненные уязвимости2

CVE-2014-7816

Средний 5

Дата публикации: 01.12.2014

CWE-22

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.17, 1.1.x before 1.1.0.CR5, and 1.2.x before 1.2.0.Beta3, when running on Windows, allows remote attackers to read arbitrary files via a .. (dot dot) in a resource URI.

CVSS 2.0

Средний 5

AV:N/AC:L/Au:N/C:P/I:N/A:N

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

CVE-2014-7816 https://nvd.nist.gov/vuln/detail/CVE-2014-7816

Ссылки3

ALT-PU-2016-3279 https://errata.altlinux.org/ALT-PU-2016-3279

GHSA-3x7h-5hfr-hvjm

https://github.com/advisories/GHSA-3x7h-5hfr-hvjm

GHSA-h6p6-fc4w-cqhx

https://github.com/advisories/GHSA-h6p6-fc4w-cqhx

Связанные уязвимости

CVE-2014-7816

redhat

около 12 лет назад

CVE-2014-7816

nvd

почти 12 лет назад

CVE-2014-7816

debian

почти 12 лет назад

Directory traversal vulnerability in JBoss Undertow 1.0.x before 1.0.1 ...

CVE-2017-2670

CVSS3: 7.5

ubuntu

больше 8 лет назад

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.

CVE-2017-2670

CVSS3: 7.5

redhat

больше 9 лет назад

It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effectively causing DoS.