ALT-PU-2022-2559

Низкий

ALT-PU-2022-2559: package ignition update to version 2.14.0-alt1

Источник

errata.altlinux.org

Дата публикации

05.09.2022

Дата обновления

05.02.2026

Устраненные уязвимости

ALT Linux branch p10

ALT Server

ALT Virtualization Server

ALT Workstation

ALT Workstation K

ALT Education

Simply Linux

Starterkit

ALT Container

Описание

This update upgrades ignition to version 2.14.0-alt1.

Устраненные уязвимости2

BDU:2022-04103

Средний 6.5

Дата публикации: 06.07.2022

Уязвимость реализации конфигурации info-get guestinfo.ignition.config.data библиотеки Ignition, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

CVSS 3.1

Средний 6.5

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

CVSS 2.0

Низкий 3.5

AV:N/AC:M/Au:S/C:P/I:N/A:N

Access vector: Network
Complexity: Medium
Authentication: Single
Confidentiality: Partial
Integrity: None
Availability: None

Ссылки

BDU:2022-04103 https://bdu.fstec.ru/vul/2022-04103

Ссылки2

ALT-PU-2022-2559 https://errata.altlinux.org/ALT-PU-2022-2559

GHSA-hj57-j5cw-2mwp

https://github.com/advisories/GHSA-hj57-j5cw-2mwp

Связанные уязвимости

CVE-2022-1706

CVSS3: 6.5

ubuntu

больше 4 лет назад

A vulnerability was found in Ignition where ignition configs are accessible from unprivileged containers in VMs running on VMware products. This issue is only relevant in user environments where the Ignition config contains secrets. The highest threat from this vulnerability is to data confidentiality. Possible workaround is to not put secrets in the Ignition config.