ALT-PU-2024-4819

Критический

ALT-PU-2024-4819: package accel-ppp update to version 1.13.0-alt1

Источник

errata.altlinux.org

Дата публикации

01.04.2024

Дата обновления

07.03.2026

Устраненные уязвимости

ALT Linux branch p11

ALT Container

ALT Education

ALT Workstation

ALT Workstation K

ALT Server

ALT Virtualization PVE Edition

Описание

This update upgrades accel-ppp to version 1.13.0-alt1.

Устраненные уязвимости5

CVE-2020-28194

Критический 9.8

Дата публикации: 01.02.2021

CWE-191

Variable underflow exists in accel-ppp radius/packet.c when receiving a RADIUS vendor-specific attribute with length field is less than 2. It has an impact only when the attacker controls the RADIUS server, which can lead to arbitrary code execution.

CVSS 3.1

Критический 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS 2.0

Высокий 7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

Access vector: Network
Complexity: Low
Authentication: None
Confidentiality: Partial
Integrity: Partial
Availability: Partial

Ссылки

CVE-2020-28194 https://nvd.nist.gov/vuln/detail/CVE-2020-28194

Ссылки1

ALT-PU-2024-4819 https://errata.altlinux.org/ALT-PU-2024-4819

Связанные уязвимости

CVE-2020-28194

CVSS3: 9.8

nvd

почти 6 лет назад

CVE-2021-42054

CVSS3: 7.5

nvd

около 5 лет назад

ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.

GHSA-v985-f4vw-23q5

github

больше 4 лет назад

ACCEL-PPP 1.12.0 has an out-of-bounds read in triton_context_schedule if the client exits after authentication.

CVE-2021-42870

CVSS3: 7.5

nvd

больше 4 лет назад

ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.

GHSA-qpw6-gmmf-vxhp

CVSS3: 7.5

github

больше 4 лет назад

ACCEL-PPP 1.12.0 has an out-of-bounds read in post_msg when processing a call_clear_request.