ALT-BU-2023-7043-1
Branch p10_e2k update bulletin.
Package python3-module-ruamel-yaml updated to version 0.17.21-alt2 for branch p10_e2k.
Closed bugs
Устаревшая ссылка на домашнюю страницу
Package python3-module-httpx updated to version 0.24.0-alt1 for branch p10_e2k.
Closed vulnerabilities
BDU:2022-07059
Уязвимость библиотеки Encode OSS HTTPX, связанная с недостаточной проверкой вводимых данных, позволяющая нарушителю обойти существующие ограничения безопасности
Modified: 2024-11-21
CVE-2021-41945
Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_with`.
- http://encode.com
- http://encode.com
- https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
- https://gist.github.com/lebr0nli/4edb76bbd3b5ff993cf44f2fbce5e571
- https://github.com/encode/httpx
- https://github.com/encode/httpx
- https://github.com/encode/httpx/discussions/1831
- https://github.com/encode/httpx/discussions/1831
- https://github.com/encode/httpx/issues/2184
- https://github.com/encode/httpx/issues/2184
- https://github.com/encode/httpx/releases/tag/0.23.0
- https://github.com/encode/httpx/releases/tag/0.23.0
Package open-iscsi updated to version 2.1.9-alt1 for branch p10_e2k.
Closed vulnerabilities
BDU:2021-01237
Уязвимость компонента uIP TCP/IP Stack операционной системы Contiki OS, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2021-01270
Уязвимость функции uip_process операционной системы Contiki OS, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2023-01682
Уязвимость функции uip_process компонента net/ipv4/uip.c реализации iSCSI Open-iSCSI, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2020-13987
An issue was discovered in Contiki through 3.0. An Out-of-Bounds Read vulnerability exists in the uIP TCP/IP Stack component when calculating the checksums for IP packets in upper_layer_chksum in net/ipv4/uip.c.
- https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
- https://www.kb.cert.org/vuls/id/815128
- https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf
- https://www.kb.cert.org/vuls/id/815128
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
Modified: 2024-11-21
CVE-2020-13988
An issue was discovered in Contiki through 3.0. An Integer Overflow exists in the uIP TCP/IP Stack component when parsing TCP MSS options of IPv4 network packets in uip_process in net/ipv4/uip.c.
Modified: 2024-11-21
CVE-2020-17437
An issue was discovered in uIP 1.0, as used in Contiki 3.0 and other products. When the Urgent flag is set in a TCP packet, and the stack is configured to ignore the urgent data, the stack attempts to use the value of the Urgent pointer bytes to separate the Urgent data from the normal data, by calculating the offset at which the normal data should be present in the global buffer. However, the length of this offset is not checked; therefore, for large values of the Urgent pointer bytes, the data pointer can point to memory that is way beyond the data buffer in uip_process in uip.c.
- https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-541018.pdf
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
- https://us-cert.cisa.gov/ics/advisories/icsa-20-343-01
- https://www.kb.cert.org/vuls/id/815128
- https://www.kb.cert.org/vuls/id/815128
Closed bugs
Не запускается сервис iscsid
Package python3-module-django updated to version 3.2.22-alt1 for branch p10_e2k.
Closed vulnerabilities
BDU:2023-07321
Уязвимость программной платформы для веб-приложений Django, связанная c неэффективной сложностью регулярных выражений, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2023-41164
In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denial of service) attack via certain inputs with a very large number of Unicode characters.
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- FEDORA-2023-a67af7d8f4
- FEDORA-2023-a67af7d8f4
- FEDORA-2024-84fbbbb914
- FEDORA-2024-84fbbbb914
- https://security.netapp.com/advisory/ntap-20231214-0002/
- https://security.netapp.com/advisory/ntap-20231214-0002/
- https://www.djangoproject.com/weblog/2023/sep/04/security-releases/
- https://www.djangoproject.com/weblog/2023/sep/04/security-releases/
Modified: 2024-11-21
CVE-2023-43665
In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when used with html=True) are subject to a potential DoS (denial of service) attack via certain inputs with very long, potentially malformed HTML text. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which are thus also vulnerable. NOTE: this issue exists because of an incomplete fix for CVE-2019-14232.
- [oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
- [oss-security] 20240304 Django: CVE-2024-27351: Potential regular expression denial-of-service in django.utils.text.Truncator.words()
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://docs.djangoproject.com/en/4.2/releases/security/
- https://groups.google.com/forum/#%21forum/django-announce
- https://groups.google.com/forum/#%21forum/django-announce
- FEDORA-2023-a67af7d8f4
- FEDORA-2023-a67af7d8f4
- FEDORA-2024-84fbbbb914
- FEDORA-2024-84fbbbb914
- https://security.netapp.com/advisory/ntap-20231221-0001/
- https://security.netapp.com/advisory/ntap-20231221-0001/
- https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
- https://www.djangoproject.com/weblog/2023/oct/04/security-releases/
Package xfce4-terminal updated to version 1.1.1-alt2 for branch p10_e2k.
Closed bugs
Не предоставляет x-terminal-emulator
Closed bugs
xfwm4 сегфолтится у нового пользователя
Closed vulnerabilities
BDU:2023-05198
Уязвимость функции parseit библиотеки для обработки JSON файлов JSON-C, позволяющая нарушителю выполнить произвольный код
Modified: 2025-04-02
CVE-2021-32292
An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A stack-buffer-overflow exists in the auxiliary sample program json_parse which is located in the function parseit.
Package make-initrd updated to version 2.31.0-alt6.E2K.1 for branch p10_e2k.
Closed bugs
Не работает поддержка /etc/crypttab в luks
При загрузке системы вылезает ошибка modprobe: FATAL: Module efivarfs not found