ALT-BU-2023-3686-1
Branch sisyphus_mipsel update bulletin.
Package lua5.1 updated to version 5.1.5-alt21 for branch sisyphus_mipsel.
Closed bugs
Liblua5.1 должен предоставлять зависимость на lua5.1(coroutine)
Package python3-module-requests updated to version 2.31.0-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
Modified: 2025-02-13
CVE-2023-32681
Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint. This is a product of how we use `rebuild_proxies` to reattach the `Proxy-Authorization` header to requests. For HTTP connections sent through the tunnel, the proxy will identify the header in the request itself and remove it prior to forwarding to the destination server. However when sent over HTTPS, the `Proxy-Authorization` header must be sent in the CONNECT request as the proxy has no visibility into the tunneled request. This results in Requests forwarding proxy credentials to the destination server unintentionally, allowing a malicious actor to potentially exfiltrate sensitive information. This issue has been patched in version 2.31.0.
- https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5
- https://github.com/psf/requests/commit/74ea7cf7a6a27a4eeb2ae24e162bcc942a6706d5
- https://github.com/psf/requests/releases/tag/v2.31.0
- https://github.com/psf/requests/releases/tag/v2.31.0
- https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q
- https://github.com/psf/requests/security/advisories/GHSA-j8r2-6x86-q33q
- https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html
- https://lists.debian.org/debian-lts-announce/2023/06/msg00018.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/AW7HNFGYP44RT3DUDQXG2QT3OEV2PJ7Y/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYASTZDGQG2BWLSNBPL3TQRL2G7QYNZ/
- https://security.gentoo.org/glsa/202309-08
- https://security.gentoo.org/glsa/202309-08
Package eepm updated to version 3.57.3-alt1 for branch sisyphus_mipsel.
Closed bugs
epm play flyview-server: не запускается сервис ipera-mediaserver
Невозможно установить far2l-portable через appinstall на Alt Workstation 10.1
Package etersoft-build-utils updated to version 3.2.5-alt1 for branch sisyphus_mipsel.
Closed bugs
Error in loginhsh: /etc/eterbuild/apt/apt.conf.SS is missed
Некорректная работа утилиты rpmgp
Package cryptmount updated to version 6.2.0-alt1 for branch sisyphus_mipsel.
Closed bugs
/etc/default/cryptmount
Package GLEW updated to version 2.2.0-alt2 for branch sisyphus_mipsel.
Closed bugs
Нужно пересобрать с поддержкой EGL