ALT-BU-2023-4403-1
Branch p10 update bulletin.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-1667
A NULL pointer dereference was found In libssh during re-keying with algorithm guessing. This issue may allow an authenticated client to cause a denial of service.
- http://www.libssh.org/security/advisories/CVE-2023-1667.txt
- http://www.libssh.org/security/advisories/CVE-2023-1667.txt
- https://access.redhat.com/security/cve/CVE-2023-1667
- https://access.redhat.com/security/cve/CVE-2023-1667
- https://bugzilla.redhat.com/show_bug.cgi?id=2182199
- https://bugzilla.redhat.com/show_bug.cgi?id=2182199
- [debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update
- [debian-lts-announce] 20230529 [SECURITY] [DLA 3437-1] libssh security update
- FEDORA-2023-5fa5ca2043
- FEDORA-2023-5fa5ca2043
- GLSA-202312-05
- GLSA-202312-05
Modified: 2024-11-21
CVE-2023-2283
A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signature` function in memory allocation problems. This issue may happen if there is insufficient memory or the memory usage is limited. The problem is caused by the return value `rc,` which is initialized to SSH_ERROR and later rewritten to save the return value of the function call `pki_key_check_hash_compatible.` The value of the variable is not changed between this point and the cryptographic verification. Therefore any error between them calls `goto error` returning SSH_OK.
- http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html
- https://access.redhat.com/security/cve/CVE-2023-2283
- https://bugzilla.redhat.com/show_bug.cgi?id=2189736
- FEDORA-2023-5fa5ca2043
- GLSA-202312-05
- https://security.netapp.com/advisory/ntap-20240201-0005/
- https://www.libssh.org/security/advisories/CVE-2023-2283.txt
- http://packetstormsecurity.com/files/172861/libssh-0.9.6-0.10.4-pki_verify_data_signature-Authorization-Bypass.html
- https://www.libssh.org/security/advisories/CVE-2023-2283.txt
- https://security.netapp.com/advisory/ntap-20240201-0005/
- GLSA-202312-05
- FEDORA-2023-5fa5ca2043
- https://bugzilla.redhat.com/show_bug.cgi?id=2189736
- https://access.redhat.com/security/cve/CVE-2023-2283
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-29406
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.
- https://go.dev/cl/506996
- https://go.dev/issue/60374
- https://groups.google.com/g/golang-announce/c/2q13H6LEEx0
- https://pkg.go.dev/vuln/GO-2023-1878
- https://security.gentoo.org/glsa/202311-09
- https://security.netapp.com/advisory/ntap-20230814-0002/
- https://go.dev/cl/506996
- https://security.netapp.com/advisory/ntap-20230814-0002/
- https://security.gentoo.org/glsa/202311-09
- https://pkg.go.dev/vuln/GO-2023-1878
- https://groups.google.com/g/golang-announce/c/2q13H6LEEx0
- https://go.dev/issue/60374
Package python3-module-django updated to version 3.2.20-alt1 for branch p10 in task 324745.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2023-36053
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large number of domain name labels of emails and URLs.
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- [debian-lts-announce] 20230719 [SECURITY] [DLA 3500-1] python-django security update
- [debian-lts-announce] 20230719 [SECURITY] [DLA 3500-1] python-django security update
- FEDORA-2023-9d36d373f1
- FEDORA-2023-9d36d373f1
- FEDORA-2023-cc023fabb7
- FEDORA-2023-cc023fabb7
- FEDORA-2024-84fbbbb914
- FEDORA-2024-84fbbbb914
- DSA-5465
- DSA-5465
- https://www.djangoproject.com/weblog/2023/jul/03/security-releases/
- https://www.djangoproject.com/weblog/2023/jul/03/security-releases/
Closed bugs
xapp-sn-wathcer крашится после ПКМ по приложению в трее
Package cinnamon-desktop updated to version 5.6.1-alt1 for branch p10 in task 321918.
Closed bugs
Неверный дефолтный путь до обоев
Closed bugs
В cinnamon не входит cinnamon-control-center