Branch sisyphus_e2k update bulletin.

Package mailman updated to version 2.1.38-alt1 for branch sisyphus_e2k.

Published: 2022-02-04

BDU:2022-00592

Уязвимость пакета управления рассылками электронных писем GNU Mailman, связанная с недостаточной проверкой источника HTTP-запроса, позволяющая нарушителю выполнять атаки с подделкой межсайтовых запросов

Severity: MEDIUM (6.1) Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Severity: MEDIUM (6.4) Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

References:

CVE-2021-44227

Published: 2021-12-02
Modified: 2024-11-21

CVE-2021-44227

In GNU Mailman before 2.1.38, a list member or moderator can get a CSRF token and craft an admin request (using that token) to set a new admin password or make other changes.

Severity: MEDIUM (6.8) Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: HIGH (8.8) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References:

Package lldpd updated to version 1.0.13-alt1 for branch sisyphus_e2k.

Published: 2023-04-15
Modified: 2025-02-06

CVE-2021-43612

In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via short SONMP packets.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Version: 2.1.2

Branch sisyphus_e2k update on 2021-12-11

ALT-BU-2021-4567-1

ALT-PU-2021-4565-1

Closed vulnerabilities

BDU:2022-00592

CVE-2021-44227

ALT-PU-2021-4566-1

Closed vulnerabilities

CVE-2021-43612