Уязвимость библиотеки github.com/containers/image, связанная с неправильной проверкой значения целостности, позволяющая нарушителю вызвать отказ в обслуживании, выполнить атаку обхода локального пути или оказать иное воздействие

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

Уязвимость корневых сертификатов e-Tugra пакета для проверки надежности сертификатов SSL Certifi, позволяющая нарушителю реализовать атаку типа «человек посередине»

Уязвимость пакета для проверки надежности сертификатов SSL Certifi, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю оказать влияние на целостность защищаемой информации

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi prior to version 2023.07.22 recognizes "e-Tugra" root certificates. e-Tugra's root certificates were subject to an investigation prompted by reporting of security issues in their systems. Certifi 2023.07.22 removes root certificates from "e-Tugra" from the root store.

Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi starting in 2021.5.30 and prior to 2024.7.4 recognized root certificates from `GLOBALTRUST`. Certifi 2024.7.04 removes root certificates from `GLOBALTRUST` from the root store. These are in the process of being removed from Mozilla's trust store. `GLOBALTRUST`'s root certificates are being removed pursuant to an investigation which identified "long-running and unresolved compliance issues."