2024-10-28
ALT-BU-2024-14782-1
Branch c10f1 update bulletin.
Package python3-module-rencode updated to version 1.0.6-alt3 for branch c10f1 in task 360500.
Closed vulnerabilities
Published: 2021-09-10
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2021-40839
The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack that consumes CPU and memory.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75
- https://github.com/aresch/rencode/commit/572ff74586d9b1daab904c6f7f7009ce0143bb75
- https://github.com/aresch/rencode/pull/29
- https://github.com/aresch/rencode/pull/29
- FEDORA-2022-02340931ec
- FEDORA-2022-02340931ec
- FEDORA-2022-1033a2718b
- FEDORA-2022-1033a2718b
- https://pypi.org/project/rencode/#history
- https://pypi.org/project/rencode/#history
- https://seclists.org/fulldisclosure/2021/Sep/16
- https://seclists.org/fulldisclosure/2021/Sep/16
- https://security.netapp.com/advisory/ntap-20211008-0001/
- https://security.netapp.com/advisory/ntap-20211008-0001/
Closed vulnerabilities
Published: 2024-08-01
BDU:2024-07429
Уязвимость набора инструментов XML для Ruby REXML, связанная с неконтролируемым потреблением ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
Published: 2024-08-01
Modified: 2024-12-27
Modified: 2024-12-27
CVE-2024-41123
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References:
- https://github.com/ruby/rexml/security/advisories/GHSA-4xqq-m2hx-25v8
- https://github.com/ruby/rexml/security/advisories/GHSA-r55c-59qm-vjw6
- https://github.com/ruby/rexml/security/advisories/GHSA-vg3r-rm7w-2xgh
- https://security.netapp.com/advisory/ntap-20241227-0005/
- https://www.ruby-lang.org/en/news/2024/08/01/dos-rexml-cve-2024-41123