cvrf2cusa/cvrf/2022/cvrf-openEuler-SA-2022-2100.xml

<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns="http://www.icasi.org/CVRF/schema/cvrf/1.1" xmlns:cvrf="http://www.icasi.org/CVRF/schema/cvrf/1.1">
	<DocumentTitle xml:lang="en">An update for bash is now available for openEuler-22.03-LTS</DocumentTitle>
	<DocumentType>Security Advisory</DocumentType>
	<DocumentPublisher Type="Vendor">
		<ContactDetails>openeuler-security@openeuler.org</ContactDetails>
		<IssuingAuthority>openEuler security committee</IssuingAuthority>
	</DocumentPublisher>
	<DocumentTracking>
		<Identification>
			<ID>openEuler-SA-2022-2100</ID>
		</Identification>
		<Status>Final</Status>
		<Version>1.0</Version>
		<RevisionHistory>
			<Revision>
				<Number>1.0</Number>
				<Date>2022-11-18</Date>
				<Description>Initial</Description>
			</Revision>
		</RevisionHistory>
		<InitialReleaseDate>2022-11-18</InitialReleaseDate>
		<CurrentReleaseDate>2022-11-18</CurrentReleaseDate>
		<Generator>
			<Engine>openEuler SA Tool V1.0</Engine>
			<Date>2022-11-18</Date>
		</Generator>
	</DocumentTracking>
	<DocumentNotes>
		<Note Title="Synopsis" Type="General" Ordinal="1" xml:lang="en">bash security update</Note>
		<Note Title="Summary" Type="General" Ordinal="2" xml:lang="en">An update for bash is now available for openEuler-22.03-LTS.</Note>
		<Note Title="Description" Type="General" Ordinal="3" xml:lang="en">Bash is the GNU Project's shell. Bash is the Bourne Again SHell. Bash is an sh-compatible shell that incorporates useful features from the Korn shell (ksh) and C shell (csh). It is intended to conform to the IEEE POSIX P1003.2/ISO 9945.2 Shell and Tools standard. It offers functional improvements over sh for both programming and interactive use. In addition, most sh scripts can be run by Bash without modification.

Security Fix(es):

A flaw was found in the bash package, where a heap-buffer overflow can occur in valid_parameter_transform. This issue may lead to memory problems.(CVE-2022-3715)</Note>
		<Note Title="Topic" Type="General" Ordinal="4" xml:lang="en">An update for bash is now available for openEuler-22.03-LTS.

openEuler Security has rated this update as having a security impact of low. A Common Vunlnerability Scoring System(CVSS)base score,which gives a detailed severity rating, is available for each vulnerability from the CVElink(s) in the References section.</Note>
		<Note Title="Severity" Type="General" Ordinal="5" xml:lang="en">Low</Note>
		<Note Title="Affected Component" Type="General" Ordinal="6" xml:lang="en">bash</Note>
	</DocumentNotes>
	<DocumentReferences>
		<Reference Type="Self">
			<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2100</URL>
		</Reference>
		<Reference Type="openEuler CVE">
			<URL>https://www.openeuler.org/en/security/cve/detail.html?id=CVE-2022-3715</URL>
		</Reference>
		<Reference Type="Other">
			<URL>https://nvd.nist.gov/vuln/detail/CVE-2022-3715</URL>
		</Reference>
	</DocumentReferences>
	<ProductTree xmlns="http://www.icasi.org/CVRF/schema/prod/1.1">
		<Branch Type="Product Name" Name="openEuler">
			<FullProductName ProductID="openEuler-22.03-LTS" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">openEuler-22.03-LTS</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="aarch64">
			<FullProductName ProductID="bash-debugsource-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-debugsource-5.1.8-6.oe2203.aarch64.rpm</FullProductName>
			<FullProductName ProductID="bash-devel-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-devel-5.1.8-6.oe2203.aarch64.rpm</FullProductName>
			<FullProductName ProductID="bash-debuginfo-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-debuginfo-5.1.8-6.oe2203.aarch64.rpm</FullProductName>
			<FullProductName ProductID="bash-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-5.1.8-6.oe2203.aarch64.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="noarch">
			<FullProductName ProductID="bash-help-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-help-5.1.8-6.oe2203.noarch.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="src">
			<FullProductName ProductID="bash-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-5.1.8-6.oe2203.src.rpm</FullProductName>
		</Branch>
		<Branch Type="Package Arch" Name="x86_64">
			<FullProductName ProductID="bash-debugsource-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-debugsource-5.1.8-6.oe2203.x86_64.rpm</FullProductName>
			<FullProductName ProductID="bash-debuginfo-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-debuginfo-5.1.8-6.oe2203.x86_64.rpm</FullProductName>
			<FullProductName ProductID="bash-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-5.1.8-6.oe2203.x86_64.rpm</FullProductName>
			<FullProductName ProductID="bash-devel-5.1.8-6" CPE="cpe:/a:openEuler:openEuler:22.03-LTS">bash-devel-5.1.8-6.oe2203.x86_64.rpm</FullProductName>
		</Branch>
	</ProductTree>
	<Vulnerability Ordinal="1" xmlns="http://www.icasi.org/CVRF/schema/vuln/1.1">
		<Notes>
			<Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">A heap-buffer-overflow in valid_parameter_transform function.</Note>
		</Notes>
		<ReleaseDate>2022-11-18</ReleaseDate>
		<CVE>CVE-2022-3715</CVE>
		<ProductStatuses>
			<Status Type="Fixed">
				<ProductID>openEuler-22.03-LTS</ProductID>
			</Status>
		</ProductStatuses>
		<Threats>
			<Threat Type="Impact">
				<Description>Low</Description>
			</Threat>
		</Threats>
		<CVSSScoreSets>
			<ScoreSet>
				<BaseScore>4.0</BaseScore>
				<Vector>AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H</Vector>
			</ScoreSet>
		</CVSSScoreSets>
		<Remediations>
			<Remediation Type="Vendor Fix">
				<Description>bash security update</Description>
				<DATE>2022-11-18</DATE>
				<URL>https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-2100</URL>
			</Remediation>
		</Remediations>
	</Vulnerability>
</cvrfdoc>