—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3856
ocsinventory-server update for php-cas
10 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: ocsinventory-server
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2022-39369
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2023/07/msg00008.html
Comment: CVSS (Max): 8.0 CVE-2022-39369 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
– ————————–BEGIN INCLUDED TEXT——————–
– ————————————————————————-
Debian LTS Advisory DLA-3486-1 [email protected]
https://www.debian.org/lts/security/ Tobias Frost
July 08, 2023 https://wiki.debian.org/LTS
– ————————————————————————-
Package : ocsinventory-server
Version : 2.5+dfsg1-1+deb10u1
CVE ID : n/a
Debian Bug :
The source package ocsinventory-server, a Hardware and software
inventory tool has been updated to address the API change in php-cas due
to CVE-2022-39369, see DLA 3485-1 for details.
CAS is an optional authentication mechanism in the binary package
ocsinventory-reports, and if used, ocsinventory-reports will stop
working until it has been reconfigured:
It now requires the baseURL of to-be-authenticated service to be
configured.
For ocsinventory-reports, this is configured with the variable
$cas_service_base_url in the file
/usr/share/ocsinventory-reports/backend/require/cas.config.php
Warning: regardless of this update, ocsreports-server should only be
used in secure and trusted environments.
For Debian 10 buster, this update is available through version
2.5+dfsg1-1+deb10u1.
We recommend that you upgrade your ocsinventory-server packages.
For the detailed security status of ocsinventory-server please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ocsinventory-server
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
– —–BEGIN PGP SIGNATURE—–
iQIzBAABCAAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAmSpbWAACgkQkWT6HRe9
XTZbeRAA2Lhs/Rbx3TDbTY/SwysxD+qxGp8jqHUVJ6h8JPAUeJHjofGS/VngwZO7
IxV+RPYdHmaoydgULc6fwrrvEmFY10xd9BAoDxOwv22DfVmJlLzV9gggkHnyo5hF
Jx1OgimRIvxk2skCnGf2BPfrydpv20YUjdOyFQ7PmpLlsdmmI210YpDXGRZKadT1
CHl16OYv+1SIQhRK8ibrgCwIcGqtMo/I25IIuVtIz799gTuAGG9CC1J7NYc7L3AC
Xd3gEb6GzHhj/ehQiqNgenJnD1MvxyzVv6uEcZ4LbO0hFvGUwxwjSmUGTgVSUDKn
bvOv2H5rnAfp2ITiXqLufTSvmnykVi38eJwdHGTqcrPfjPUweE1AXvXIxB42n5dm
NZIELadtVBoedzquZSUcD4imO7WVM67TFqbdp3peMQq9vW4YDix0gF0Ww7zE6Ogc
1+E4NFFQgsb5ec0UQ8ya9xBNjIiFtbTaYfTe5Pe9ro2BtELvp7HxjNIQ4eVRP10d
uyGk1NG1KWDczgO1GFvPayGxQizpRK/6ChjGr+wW0xwIcd2VIeV9OkRLvOageCEX
mbWYnoKbZTrQ3P0vwCFLyf9QQko9fyULeJoPJxliq2yADbU8bAewpc5SDXvLtqhh
qxszL1jy9OjiLAC739XYOq2nDIuhKkyLMwQenj6CPBBSu1iYn54=
=Rpcq
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZKt0vMkNZI30y1K9AQhPQA//fPJtb6hc2sBWU0Cn45X9Me0BcKs6+Uf4
SybADPRxFRUjgx/fUANNcNCO2RIK4560PTqB9WRTHFvA6QYVY3Xh0CyGKJv7WsA4
QVO9tzSv29HF9nB04dVPRM3IwTvtj0jgS+LXHhEXbsjJagLws1IYJUezUilbNsma
iHp5galoTfio3NoUPsropVwPh0K/d/6PZGtmyYjXVK1AH+O3D1FsWwUqisVSwEaA
8u8ZhE6QlaZAaF18ujWF7dOMc7M4Q/Vin6+81YP3MF4biGbeu2y6kuGDdwwOJF7s
mhF1gzLy54Fog0u7RfOUYSdybpfyqQ7V4a3WUscfP1p1UhCRK3te1/CU7P+dLVDl
0jBV2rSZnmdZprInuCOpLB/tof5IAF43AAIfPzOcZ/UVknIvmIySS6QqwsMGk5op
TyCCS9Hce9a3YiKQcg4MwD5VTT4XQglk9+ymFya6t9EF1kxiuQctLDHbdwIok/oG
I9qlYyzhn5HeM3bY7kWw9Be9MdL4QPfCqYZPESjAnv8gyptgIBt6E9Qd9genMPDI
YkChq7ZzuAhb2+ICsz5yK39F/IJU4m0XU9kWlvl7zvXi+6pTr78vbRLn0/rJtlgf
sh5ajbdhB27ogOzwMCqmddxz5JAj9GGPOMM+DNMGY6VTQ1FtUYH/STnEqvoITWvN
O03k++kXPr4=
=mBDl
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins