158 lines
14 KiB
XML
158 lines
14 KiB
XML
<?xml version="1.0" encoding="UTF-8"?>
|
|
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
|
|
<DocumentTitle xml:lang="en">An update for clamav is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3</DocumentTitle>
|
|
<DocumentType>Security Advisory</DocumentType>
|
|
<DocumentPublisher Type="Vendor">
|
|
<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
|
|
<IssuingAuthority>openEuler security committee</IssuingAuthority>
|
|
</DocumentPublisher>
|
|
<DocumentTracking>
|
|
<Identification>
|
|
<ID>openEuler-SA-2022-1508</ID>
|
|
</Identification>
|
|
<Status>Final</Status>
|
|
<Version>1.0</Version>
|
|
<RevisionHistory>
|
|
<Revision>
|
|
<Number>1.0</Number>
|
|
<Date>2022-01-28</Date>
|
|
<Description>Initial</Description>
|
|
</Revision>
|
|
</RevisionHistory>
|
|
<InitialReleaseDate>2022-01-28</InitialReleaseDate>
|
|
<CurrentReleaseDate>2022-01-28</CurrentReleaseDate>
|
|
<Generator>
|
|
<Engine>openEuler SA Tool V1.0</Engine>
|
|
<Date>2022-01-28</Date>
|
|
</Generator>
|
|
</DocumentTracking>
|
|
<DocumentNotes>
|
|
<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">clamav security update</Note>
|
|
<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for clamav is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3.</Note>
|
|
<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">End-user tools for the Clam Antivirus scanner.
|
|
|
|
Security Fix(es):
|
|
|
|
A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.(CVE-2022-20698)</Note>
|
|
<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for clamav is now available for openEuler-20.03-LTS-SP1,openEuler-20.03-LTS-SP2 and openEuler-20.03-LTS-SP3.
|
|
|
|
openEuler Security has rated this update as having a security impact of high. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
|
|
<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">High</Note>
|
|
<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">clamav</Note>
|
|
</DocumentNotes>
|
|
<DocumentReferences>
|
|
<Reference Type="Self">
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1508</URL>
|
|
</Reference>
|
|
<Reference Type="openEuler CVE">
|
|
<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-20698</URL>
|
|
</Reference>
|
|
<Reference Type="Other">
|
|
<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-20698</URL>
|
|
</Reference>
|
|
</DocumentReferences>
|
|
<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
|
|
<Branch Type="Product Name" Name="openEuler">
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP1" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">openEuler-20.03-LTS-SP1</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP2" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">openEuler-20.03-LTS-SP2</FullProductName>
|
|
<FullProductName ProductID="openEuler-20.03-LTS-SP3" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">openEuler-20.03-LTS-SP3</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="aarch64">
|
|
<FullProductName ProductID="clamav-debugsource-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-debugsource-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamd-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamd-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-milter-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-milter-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debuginfo-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-debuginfo-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-help-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-help-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-update-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-update-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-devel-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-devel-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-update-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-update-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debuginfo-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-debuginfo-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-milter-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-milter-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-devel-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-devel-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamd-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamd-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-help-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-help-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debugsource-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-debugsource-0.103.2-4.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamd-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamd-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debuginfo-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-debuginfo-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-devel-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-devel-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-update-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-update-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-help-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-help-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-milter-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-milter-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debugsource-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-debugsource-0.103.2-5.oe1.aarch64.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="noarch">
|
|
<FullProductName ProductID="clamav-filesystem-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-filesystem-0.103.2-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-data-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-data-0.103.2-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-data-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-data-0.103.2-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-filesystem-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-filesystem-0.103.2-4.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-data-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-data-0.103.2-5.oe1.noarch.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-filesystem-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-filesystem-0.103.2-5.oe1.noarch.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="src">
|
|
<FullProductName ProductID="clamav-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-0.103.2-4.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-0.103.2-4.oe1.src.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-0.103.2-5.oe1.src.rpm</FullProductName>
|
|
</Branch>
|
|
<Branch Type="Package Arch" Name="x86_64">
|
|
<FullProductName ProductID="clamav-debuginfo-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-debuginfo-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-milter-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-milter-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamd-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamd-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-update-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-update-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-devel-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-devel-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debugsource-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-debugsource-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-help-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP1">clamav-help-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debugsource-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-debugsource-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-milter-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-milter-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-devel-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-devel-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-help-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-help-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debuginfo-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-debuginfo-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamd-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamd-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-update-0.103.2-4" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP2">clamav-update-0.103.2-4.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-help-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-help-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamd-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamd-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-devel-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-devel-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-update-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-update-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debugsource-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-debugsource-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-milter-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-milter-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
<FullProductName ProductID="clamav-debuginfo-0.103.2-5" CPE="cpe:/a:openEuler:openEuler:20.03-LTS-SP3">clamav-debuginfo-0.103.2-5.oe1.x86_64.rpm</FullProductName>
|
|
</Branch>
|
|
</ProductTree>
|
|
<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
|
|
<Notes>
|
|
<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A vulnerability in the OOXML parsing module in Clam AntiVirus (ClamAV) Software version 0.104.1 and LTS version 0.103.4 and prior versions could allow an unauthenticated, remote attacker to cause a denial of service condition on an affected device. The vulnerability is due to improper checks that may result in an invalid pointer read. An attacker could exploit this vulnerability by sending a crafted OOXML file to an affected device. An exploit could allow the attacker to cause the ClamAV scanning process to crash, resulting in a denial of service condition.</Note>
|
|
</Notes>
|
|
<ReleaseDate>2022-01-28</ReleaseDate>
|
|
<CVE>CVE-2022-20698</CVE>
|
|
<ProductStatuses>
|
|
<Status Type="Fixed">
|
|
<ProductID>openEuler-20.03-LTS-SP1</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP2</ProductID>
|
|
<ProductID>openEuler-20.03-LTS-SP3</ProductID>
|
|
</Status>
|
|
</ProductStatuses>
|
|
<Threats>
|
|
<Threat Type="Impact">
|
|
<Description>High</Description>
|
|
</Threat>
|
|
</Threats>
|
|
<CVSSScoreSets>
|
|
<ScoreSet>
|
|
<BaseScore>7.5</BaseScore>
|
|
<Vector>AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</Vector>
|
|
</ScoreSet>
|
|
</CVSSScoreSets>
|
|
<Remediations>
|
|
<Remediation Type="Vendor Fix">
|
|
<Description>clamav security update</Description>
|
|
<DATE>2022-01-28</DATE>
|
|
<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1508</URL>
|
|
</Remediation>
|
|
</Remediations>
|
|
</Vulnerability>
|
|
</cvrfdoc> |