ALT-PU-2023-1421

Высокий

ALT-PU-2023-1421: package sleuthkit update to version 4.12.0-alt1

Источник

errata.altlinux.org

Дата публикации

13.03.2023

Дата обновления

13.03.2023

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades sleuthkit to version 4.12.0-alt1.

Устраненные уязвимости1

CVE-2022-45639

Высокий 7.8

Дата публикации: 24.01.2023

CWE-78

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.

CVSS 3.1

Высокий 7.8

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector: Local
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Ссылки

CVE-2022-45639 https://nvd.nist.gov/vuln/detail/CVE-2022-45639

Ссылки1

ALT-PU-2023-1421 https://errata.altlinux.org/ALT-PU-2023-1421

Связанные уязвимости

CVE-2022-45639

CVSS3: 7.8

nvd

почти 4 года назад

CVE-2022-45639

CVSS3: 7.8

msrc

около 1 года назад

CVE-2022-45639

CVSS3: 7.8

debian

почти 4 года назад

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows ...

GHSA-v833-mfjc-7qr5

CVSS3: 9.8

github

почти 4 года назад

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter.