ALT-PU-2020-1824

Критический

ALT-PU-2020-1824: package influxdb update to version 1.8.0-alt1

Источник

errata.altlinux.org

Дата публикации

21.04.2020

Дата обновления

21.04.2020

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades influxdb to version 1.8.0-alt1.

Устраненные уязвимости1

CVE-2022-36640

Критический 9.8

Дата публикации: 02.09.2022

CWE-276

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands. NOTE: the CVE ID assignment is disputed because the vendor's documentation states "If InfluxDB is being deployed on a publicly accessible endpoint, we strongly recommend authentication be enabled. Otherwise the data will be publicly available to any unauthenticated user. The default settings do NOT enable authentication and authorization."

CVSS 3.1

Критический 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Ссылки

CVE-2022-36640 https://nvd.nist.gov/vuln/detail/CVE-2022-36640

Ссылки1

ALT-PU-2020-1824 https://errata.altlinux.org/ALT-PU-2020-1824

Связанные уязвимости

CVE-2022-36640

CVSS3: 9.8

ubuntu

около 4 лет назад

CVE-2022-36640

CVSS3: 9.8

nvd

около 4 лет назад

CVE-2022-36640

CVSS3: 9.8

debian

около 4 лет назад

influxData influxDB before v1.8.10 contains no authentication mechanis ...

GHSA-x7v4-5qjr-j62x

CVSS3: 9.8

github

около 4 лет назад

influxData influxDB before v1.8.10 contains no authentication mechanism or controls, allowing unauthenticated attackers to execute arbitrary commands.