ALT-PU-2022-3224

Критический

ALT-PU-2022-3224: package jobe update to version 1.7.0-alt1

Источник

errata.altlinux.org

Дата публикации

28.11.2022

Дата обновления

28.11.2022

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades jobe to version 1.7.0-alt1.

Устраненные уязвимости1

CVE-2020-36642

Критический 9.8

Дата публикации: 06.01.2023

CWE-77

A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The identifier of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability.

CVSS 3.1

Критический 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Средний 5.2

AV:A/AC:L/Au:S/C:P/I:P/A:P

Access vector: Adjacent_network
Complexity: Low
Authentication: Single
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2020-36642 https://nvd.nist.gov/vuln/detail/CVE-2020-36642

Ссылки1

ALT-PU-2022-3224 https://errata.altlinux.org/ALT-PU-2022-3224

Связанные уязвимости

CVE-2020-36642

CVSS3: 9.8

nvd

почти 4 года назад

GHSA-p576-j8jp-6qr7

CVSS3: 9.8

github

почти 4 года назад

A vulnerability was found in trampgeek jobe up to 1.6.x and classified as critical. This issue affects the function run_in_sandbox of the file application/libraries/LanguageTask.php. The manipulation leads to command injection. Upgrading to version 1.7.0 is able to address this issue. The name of the patch is 8f43daf50c943b98eaf0c542da901a4a16e85b02. It is recommended to upgrade the affected component. The identifier VDB-217553 was assigned to this vulnerability.

ALT-PU-2024-1386

CVSS3: 9.8

altlinux

почти 3 года назад

ALT-PU-2024-1386: package `jobe` update to version 1.9.0-alt1