ALT-BU-2024-16287-1
Branch c10f1 update bulletin.
Package python3-module-nltk updated to version 3.9.1-alt2.c10f1.1 for branch c10f1 in task 363059.
Closed vulnerabilities
BDU:2024-07075
Уязвимость функции nltk.download() пакета библиотек для символьной и статистической обработки естественного языка NLTK, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2024-39705
NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download functionality is used. This affects, for example, averaged_perceptron_tagger and punkt.
- https://github.com/nltk/nltk/issues/2522
- https://github.com/nltk/nltk/issues/2522
- https://github.com/nltk/nltk/issues/3266
- https://github.com/nltk/nltk/issues/3266
- https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
- https://www.vicarius.io/vsociety/posts/rce-in-python-nltk-cve-2024-39705-39706
Closed bugs
Resource wordnet not found
Package python3-module-gunicorn updated to version 23.0.0-alt0.p10.1 for branch c10f1 in task 363516.
Closed vulnerabilities
BDU:2024-03553
Уязвимость WSGI-сервера gunicorn, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю обойти существующие ограничения безопасности и выполнить атаку «контрабанда HTTP-запросов»
Modified: 2024-12-20
CVE-2024-1135
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00018.html
Closed bugs
Для закрытия CVE-2024-1135 необходимо обновить пакет