ALT-BU-2022-4274-1
Branch sisyphus_riscv64 update bulletin.
Package containerd updated to version 1.6.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2022-01715
Уязвимость среды выполнения контейнеров Containerd, связанная с недостатками процедуры аутентификации, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2022-23648
containerd is a container runtime available as a daemon for Linux and Windows. A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files and directories on the host. This may bypass any policy-based enforcement on container setup (including a Kubernetes Pod Security Policy) and expose potentially sensitive information. Kubernetes and crictl can both be configured to use containerd’s CRI implementation. This bug has been fixed in containerd 1.6.1, 1.5.10, and 1.4.12. Users should update to these versions to resolve the issue.
- http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html
- http://packetstormsecurity.com/files/166421/containerd-Image-Volume-Insecure-Handling.html
- https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70
- https://github.com/containerd/containerd/commit/10f428dac7cec44c864e1b830a4623af27a9fc70
- https://github.com/containerd/containerd/releases/tag/v1.4.13
- https://github.com/containerd/containerd/releases/tag/v1.4.13
- https://github.com/containerd/containerd/releases/tag/v1.5.10
- https://github.com/containerd/containerd/releases/tag/v1.5.10
- https://github.com/containerd/containerd/releases/tag/v1.6.1
- https://github.com/containerd/containerd/releases/tag/v1.6.1
- https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7
- https://github.com/containerd/containerd/security/advisories/GHSA-crp2-qrr5-8pq7
- FEDORA-2022-230f2b024b
- FEDORA-2022-230f2b024b
- FEDORA-2022-d9c9bf56f6
- FEDORA-2022-d9c9bf56f6
- FEDORA-2022-dc35dd101f
- FEDORA-2022-dc35dd101f
- GLSA-202401-31
- GLSA-202401-31
- DSA-5091
- DSA-5091
Package python updated to version 2.7.18-alt9 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2022-02302
Уязвимость модуля urllib.parse интерпретатора языка программирования Python, позволяющая нарушителю внедрить произвольные данные в ответ сервера
BDU:2022-02303
Уязвимость клиентской библиотеки FTP (File Transfer Protocol) интерпретатора языка программирования Python, позволяющая нарушителю выполнять SSRF-атаки
Modified: 2024-11-21
CVE-2021-4189
A flaw was found in Python, specifically in the FTP (File Transfer Protocol) client library in PASV (passive) mode. The issue is how the FTP client trusts the host from the PASV response by default. This flaw allows an attacker to set up a malicious FTP server that can trick FTP clients into connecting back to a given IP address and port. This vulnerability could lead to FTP client scanning ports, which otherwise would not have been possible.
- https://access.redhat.com/security/cve/CVE-2021-4189
- https://access.redhat.com/security/cve/CVE-2021-4189
- https://bugs.python.org/issue43285
- https://bugs.python.org/issue43285
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020
- https://bugzilla.redhat.com/show_bug.cgi?id=2036020
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
- https://github.com/python/cpython/commit/0ab152c6b5d95caa2dc1a30fa96e10258b5f188e
- [debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update
- [debian-lts-announce] 20230524 [SECURITY] [DLA 3432-1] python2.7 security update
- [debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update
- [debian-lts-announce] 20230630 [SECURITY] [DLA 3477-1] python3.7 security update
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html
- https://python-security.readthedocs.io/vuln/ftplib-pasv.html
- https://security.netapp.com/advisory/ntap-20221104-0004/
- https://security.netapp.com/advisory/ntap-20221104-0004/
- https://security-tracker.debian.org/tracker/CVE-2021-4189
- https://security-tracker.debian.org/tracker/CVE-2021-4189
Modified: 2024-11-21
CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
- https://bugs.python.org/issue43882
- https://bugs.python.org/issue43882
- [debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update
- [debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update
- FEDORA-2022-18ad73aba6
- FEDORA-2022-18ad73aba6
- FEDORA-2022-ef99a016f6
- FEDORA-2022-ef99a016f6
- GLSA-202305-02
- GLSA-202305-02
- https://security.netapp.com/advisory/ntap-20220225-0009/
- https://security.netapp.com/advisory/ntap-20220225-0009/
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
Package libxslt updated to version 1.1.35-alt2 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2021-03941
Уязвимость реализации технологии XSLT (eXtensible Stylesheet Language Transformations) модуля отображения Blink браузера Google Chrome, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2021-30560
Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop.html
- https://crbug.com/1219209
- https://crbug.com/1219209
- [debian-lts-announce] 20220909 [SECURITY] [DLA 3101-1] libxslt security update
- [debian-lts-announce] 20220909 [SECURITY] [DLA 3101-1] libxslt security update
- GLSA-202310-23
- GLSA-202310-23
- DSA-5216
- DSA-5216
Package alterator-net-eth updated to version 5.2.2-alt1 for branch sisyphus_riscv64.
Closed bugs
Не возможно сменить имя пк, через GUI - Центр Управления Системой (acc) в виде FQDN на Альт Сервер 10