ALT-BU-2023-7447-1
Branch sisyphus_mipsel update bulletin.
Package mysql-connector-odbc updated to version 8.0.35-alt1 for branch sisyphus_mipsel.
Closed vulnerabilities
BDU:2022-01443
Уязвимость реализации механизма аутентификации Cyrus SASL, связанная с непринятием мер по защите структуры SQL-запроса, позволяющая нарушителю выполнить произвольный SQL-запрос
BDU:2022-04284
Уязвимость режима AES OCB библиотеки OpenSSL, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-11-21
CVE-2022-2097
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=919925673d6c9cfed3c1085497f5dfbbed5fc431
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=a98f339ddd7e8f487d6e0088d4a9a42324885a93
- [debian-lts-announce] 20230220 [SECURITY] [DLA 3325-1] openssl security update
- [debian-lts-announce] 20230220 [SECURITY] [DLA 3325-1] openssl security update
- FEDORA-2022-89a17be281
- FEDORA-2022-89a17be281
- FEDORA-2022-3fdc2d3047
- FEDORA-2022-3fdc2d3047
- FEDORA-2022-41890e9e44
- FEDORA-2022-41890e9e44
- GLSA-202210-02
- GLSA-202210-02
- https://security.netapp.com/advisory/ntap-20220715-0011/
- https://security.netapp.com/advisory/ntap-20220715-0011/
- https://security.netapp.com/advisory/ntap-20230420-0008/
- https://security.netapp.com/advisory/ntap-20230420-0008/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- DSA-5343
- DSA-5343
- https://www.openssl.org/news/secadv/20220705.txt
- https://www.openssl.org/news/secadv/20220705.txt
Modified: 2024-11-21
CVE-2022-24407
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
- [oss-security] 20220223 Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906]
- [oss-security] 20220223 Fwd: Cyrus-SASL 2.1.28 released [fixes CVE-2022-24407 & CVE-2019-19906]
- https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst
- https://github.com/cyrusimap/cyrus-sasl/blob/fdcd13ceaef8de684dc69008011fa865c5b4a3ac/docsrc/sasl/release-notes/2.1/index.rst
- [debian-lts-announce] 20220306 [SECURITY] [DLA 2931-1] cyrus-sasl2 security update
- [debian-lts-announce] 20220306 [SECURITY] [DLA 2931-1] cyrus-sasl2 security update
- FEDORA-2022-e33e824d37
- FEDORA-2022-e33e824d37
- FEDORA-2022-8cc64f73d0
- FEDORA-2022-8cc64f73d0
- FEDORA-2022-f9642fab70
- FEDORA-2022-f9642fab70
- https://security.netapp.com/advisory/ntap-20221007-0003/
- https://security.netapp.com/advisory/ntap-20221007-0003/
- https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28
- https://www.cyrusimap.org/sasl/sasl/release-notes/2.1/index.html#new-in-2-1-28
- DSA-5087
- DSA-5087
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://www.oracle.com/security-alerts/cpujul2022.html
Package highlight updated to version 4.3-alt2 for branch sisyphus_mipsel.
Closed bugs
highlight: perl XS does not link with -lperl