ALT-BU-2020-3868-1
Branch p9 update bulletin.
Closed bugs
Не запускается nagstamon -> ModuleNotFoundError: No module named 'requests_gssapi'
Closed bugs
conflict with old python-module-custodia due to files
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-12658
gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.
- https://github.com/gssapi/gssproxy/commit/cb761412e299ef907f22cd7c4146d50c8a792003
- https://github.com/gssapi/gssproxy/compare/v0.8.2...v0.8.3
- [debian-lts-announce] 20210104 [SECURITY] [DLA 2516-1] gssproxy security update
- https://pagure.io/gssproxy/c/cb761412e299ef907f22cd7c4146d50c8a792003?branch=master
- https://github.com/gssapi/gssproxy/commit/cb761412e299ef907f22cd7c4146d50c8a792003
- https://pagure.io/gssproxy/c/cb761412e299ef907f22cd7c4146d50c8a792003?branch=master
- [debian-lts-announce] 20210104 [SECURITY] [DLA 2516-1] gssproxy security update
- https://github.com/gssapi/gssproxy/compare/v0.8.2...v0.8.3
Package python-module-urllib3 updated to version 1.25.6-alt1 for branch p9 in task 250567.
Closed vulnerabilities
BDU:2022-00586
Уязвимость HTTP-клиента для Python urllib3, связанная с неконтролируемым потреблением ресурсов, позволяющая нарушителю выполнить отказ в обслуживании
Modified: 2024-11-21
CVE-2021-33503
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.
- https://github.com/advisories/GHSA-q2q7-5pp4-w6pg
- https://github.com/advisories/GHSA-q2q7-5pp4-w6pg
- https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec
- https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec
- FEDORA-2021-9c5f3b8aae
- FEDORA-2021-9c5f3b8aae
- FEDORA-2021-a6bde7ab18
- FEDORA-2021-a6bde7ab18
- GLSA-202107-36
- GLSA-202107-36
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
Closed vulnerabilities
Modified: 2024-11-21
CVE-2020-1722
A flaw was found in all ipa versions 4.x.x through 4.8.0. When sending a very long password (>= 1,000,000 characters) to the server, the password hashing process could exhaust memory and CPU leading to a denial of service and the website becoming unresponsive. The highest threat from this vulnerability is to system availability.
Closed bugs
Просьба обновить до 1.4.2