Anolis OS update for idm:DL1 module
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2020-17049 CVE-2023-5455 |
| CWE-ID | CWE-254 CWE-352 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system python3-ipatests Operating systems & Components / Operating system package or component python3-ipaserver Operating systems & Components / Operating system package or component python3-ipalib Operating systems & Components / Operating system package or component python3-ipaclient Operating systems & Components / Operating system package or component ipa-server-dns Operating systems & Components / Operating system package or component ipa-server-common Operating systems & Components / Operating system package or component ipa-selinux Operating systems & Components / Operating system package or component ipa-python-compat Operating systems & Components / Operating system package or component ipa-healthcheck-core Operating systems & Components / Operating system package or component ipa-healthcheck Operating systems & Components / Operating system package or component ipa-common Operating systems & Components / Operating system package or component ipa-client-common Operating systems & Components / Operating system package or component slapi-nis Operating systems & Components / Operating system package or component ipa-server-trust-ad Operating systems & Components / Operating system package or component ipa-server Operating systems & Components / Operating system package or component ipa-client-samba Operating systems & Components / Operating system package or component ipa-client-epn Operating systems & Components / Operating system package or component ipa-client Operating systems & Components / Operating system package or component bind-dyndb-ldap Operating systems & Components / Operating system package or component python3-yubico Operating systems & Components / Operating system package or component python3-pyusb Operating systems & Components / Operating system package or component python3-jwcrypto Operating systems & Components / Operating system package or component python3-qrcode-core Operating systems & Components / Operating system package or component python3-qrcode Operating systems & Components / Operating system package or component python3-kdcproxy Operating systems & Components / Operating system package or component python3-custodia Operating systems & Components / Operating system package or component custodia Operating systems & Components / Operating system package or component softhsm-devel Operating systems & Components / Operating system package or component softhsm Operating systems & Components / Operating system package or component opendnssec Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Security Features
EUVDB-ID: #VU48269
Risk: Low
CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2020-17049
CWE-ID:
CWE-254 - Security Features
Exploit availability: No
DescriptionThe vulnerability allows a remote user to bypass authentication process.
The vulnerability exists due to security feature bypass issue in Kerberos. A remote administrator can bypass authentication process and gain unauthorized access to the application.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 8
python3-ipatests: before 4.9.12-11.0.1
python3-ipaserver: before 4.9.12-11.0.1
python3-ipalib: before 4.9.12-11.0.1
python3-ipaclient: before 4.9.12-11.0.1
ipa-server-dns: before 4.9.12-11.0.1
ipa-server-common: before 4.9.12-11.0.1
ipa-selinux: before 4.9.12-11.0.1
ipa-python-compat: before 4.9.12-11.0.1
ipa-healthcheck-core: before 0.12-3
ipa-healthcheck: before 0.12-3
ipa-common: before 4.9.12-11.0.1
ipa-client-common: before 4.9.12-11.0.1
slapi-nis: before 0.60.0-4.0.1
ipa-server-trust-ad: before 4.9.12-11.0.1
ipa-server: before 4.9.12-11.0.1
ipa-client-samba: before 4.9.12-11.0.1
ipa-client-epn: before 4.9.12-11.0.1
ipa-client: before 4.9.12-11.0.1
bind-dyndb-ldap: before 11.6-4
python3-yubico: before 1.3.2-9.1
python3-pyusb: before 1.0.0-9.1
python3-jwcrypto: before 0.5.0-1.1
python3-qrcode-core: before 5.1-12
python3-qrcode: before 5.1-12
python3-kdcproxy: before 0.4-5
python3-custodia: before 0.6.0-3
custodia: before 0.6.0-3
softhsm-devel: before 2.6.0-5
softhsm: before 2.6.0-5
opendnssec: before 2.1.7-1
CPE2.3- cpe:2.3:o:openanolis:anolis_os:8:*:*:*:*:*:*:*
- cpe:2.3:o:openanolis:python3-ipatests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-ipaserver:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-ipalib:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-ipaclient:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server-dns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-selinux:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-python-compat:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-healthcheck-core:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-healthcheck:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:slapi-nis:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server-trust-ad:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client-samba:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client-epn:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:bind-dyndb-ldap:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-yubico:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-pyusb:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-jwcrypto:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-qrcode-core:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-qrcode:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-kdcproxy:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-custodia:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:custodia:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:softhsm-devel:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:softhsm:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:opendnssec:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:0045
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Cross-site request forgery
EUVDB-ID: #VU85268
Risk: Medium
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2023-5455
CWE-ID:
CWE-352 - Cross-Site Request Forgery (CSRF)
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform cross-site request forgery attacks.
The vulnerability exists due to insufficient validation of the HTTP request origin. A remote attacker can trick the victim to visit a specially crafted web page and perform arbitrary actions on behalf of the victim on the vulnerable website.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 8
python3-ipatests: before 4.9.12-11.0.1
python3-ipaserver: before 4.9.12-11.0.1
python3-ipalib: before 4.9.12-11.0.1
python3-ipaclient: before 4.9.12-11.0.1
ipa-server-dns: before 4.9.12-11.0.1
ipa-server-common: before 4.9.12-11.0.1
ipa-selinux: before 4.9.12-11.0.1
ipa-python-compat: before 4.9.12-11.0.1
ipa-healthcheck-core: before 0.12-3
ipa-healthcheck: before 0.12-3
ipa-common: before 4.9.12-11.0.1
ipa-client-common: before 4.9.12-11.0.1
slapi-nis: before 0.60.0-4.0.1
ipa-server-trust-ad: before 4.9.12-11.0.1
ipa-server: before 4.9.12-11.0.1
ipa-client-samba: before 4.9.12-11.0.1
ipa-client-epn: before 4.9.12-11.0.1
ipa-client: before 4.9.12-11.0.1
bind-dyndb-ldap: before 11.6-4
python3-yubico: before 1.3.2-9.1
python3-pyusb: before 1.0.0-9.1
python3-jwcrypto: before 0.5.0-1.1
python3-qrcode-core: before 5.1-12
python3-qrcode: before 5.1-12
python3-kdcproxy: before 0.4-5
python3-custodia: before 0.6.0-3
custodia: before 0.6.0-3
softhsm-devel: before 2.6.0-5
softhsm: before 2.6.0-5
opendnssec: before 2.1.7-1
CPE2.3- cpe:2.3:o:openanolis:anolis_os:8:*:*:*:*:*:*:*
- cpe:2.3:o:openanolis:python3-ipatests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-ipaserver:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-ipalib:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-ipaclient:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server-dns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-selinux:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-python-compat:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-healthcheck-core:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-healthcheck:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:slapi-nis:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server-trust-ad:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-server:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client-samba:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client-epn:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:ipa-client:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:bind-dyndb-ldap:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-yubico:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-pyusb:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-jwcrypto:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-qrcode-core:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-qrcode:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-kdcproxy:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-custodia:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:custodia:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:softhsm-devel:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:softhsm:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:opendnssec:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2024:0045
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
