Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2019:1111-1

Опубликовано: 02 апр. 2019
Источник: suse-cvrf

Описание

Security update for openwsman

This update for openwsman fixes the following issues:

Security issues fixed:

  • CVE-2019-3816: Fixed a vulnerability in openwsmand deamon which could lead to arbitary file disclosure (bsc#1122623).
  • CVE-2019-3833: Fixed a vulnerability in process_connection() which could allow an attacker to trigger an infinite loop which leads to Denial of Service (bsc#1122623).

Other issues addressed:

  • Added OpenSSL 1.1 compatibility
  • Compilation in debug mode fixed
  • Directory listing without authentication fixed (bsc#1092206).

This update was imported from the SUSE:SLE-15:Update update project.

Список пакетов

openSUSE Leap 15.0
libwsman-devel-2.6.7-lp150.2.3.1
libwsman3-2.6.7-lp150.2.3.1
libwsman_clientpp-devel-2.6.7-lp150.2.3.1
libwsman_clientpp1-2.6.7-lp150.2.3.1
openwsman-java-2.6.7-lp150.2.3.1
openwsman-perl-2.6.7-lp150.2.3.1
openwsman-ruby-2.6.7-lp150.2.3.1
openwsman-ruby-docs-2.6.7-lp150.2.3.1
openwsman-server-2.6.7-lp150.2.3.1
openwsman-server-plugin-ruby-2.6.7-lp150.2.3.1
python3-openwsman-2.6.7-lp150.2.3.1
winrs-2.6.7-lp150.2.3.1

Ссылки

Описание

Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory. A remote, unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP request to openwsman server.

Затронутые продукты
openSUSE Leap 15.0:libwsman-devel-2.6.7-lp150.2.3.1
openSUSE Leap 15.0:libwsman3-2.6.7-lp150.2.3.1
openSUSE Leap 15.0:libwsman_clientpp-devel-2.6.7-lp150.2.3.1
openSUSE Leap 15.0:libwsman_clientpp1-2.6.7-lp150.2.3.1
Ссылки

Описание

Openwsman, versions up to and including 2.6.9, are vulnerable to infinite loop in process_connection() when parsing specially crafted HTTP requests. A remote, unauthenticated attacker can exploit this vulnerability by sending malicious HTTP request to cause denial of service to openwsman server.

Затронутые продукты
openSUSE Leap 15.0:libwsman-devel-2.6.7-lp150.2.3.1
openSUSE Leap 15.0:libwsman3-2.6.7-lp150.2.3.1
openSUSE Leap 15.0:libwsman_clientpp-devel-2.6.7-lp150.2.3.1
openSUSE Leap 15.0:libwsman_clientpp1-2.6.7-lp150.2.3.1
Ссылки