ALT-BU-2024-3126-1
Branch sisyphus_riscv64 update bulletin.
Package vim updated to version 9.1.0050-alt2 for branch sisyphus_riscv64.
Closed bugs
incorrect output with -i flag
Package wireshark updated to version 4.2.2-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2024-00164
Уязвимость диссектора GVCP анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2024-00215
Уязвимость плагин-диссектора IEEE 1609.2 анализатора трафика компьютерных сетей Wireshark, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2024-11-21
CVE-2024-0207
HTTP3 dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file
Modified: 2024-11-21
CVE-2024-0208
GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file
- GitLab Issue #19496
- GitLab Issue #19496
- https://lists.debian.org/debian-lts-announce/2024/02/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/34DBP5P2RHQ7XUABPANYYMOGV5KS6VEP/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MADSCHKZSCKQ5NLIX3UMOIJD2JZ65L4V/
- https://www.wireshark.org/security/wnpa-sec-2024-01.html
- https://www.wireshark.org/security/wnpa-sec-2024-01.html
Modified: 2024-11-21
CVE-2024-0209
IEEE 1609.2 dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection or crafted capture file
Modified: 2024-11-21
CVE-2024-0210
Zigbee TLV dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file
Modified: 2024-11-21
CVE-2024-0211
DOCSIS dissector crash in Wireshark 4.2.0 allows denial of service via packet injection or crafted capture file
Package mate-control-center updated to version 1.26.1-alt3 for branch sisyphus_riscv64.
Closed bugs
Параметры внешнего вида. Среди значений стиль "Масштаб" присутствует два раза
Package php8.2-swoole updated to version 5.1.2-alt1.16 for branch sisyphus_riscv64.
Closed bugs
/usr/lib64/php/8.3.1/extensions/swoole.so.so: cannot open shared object file: No such file or directory
Package php8.3-swoole updated to version 5.1.2-alt1.3 for branch sisyphus_riscv64.
Closed bugs
/usr/lib64/php/8.3.1/extensions/swoole.so.so: cannot open shared object file: No such file or directory
Package redis updated to version 7.2.4-alt0.port for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2023-05475
Уязвимость системы управления базами данных Redis, связанная с небезопасным управлением привилегиями, позволяющая нарушителю получить несанкционированный доступ к ключам, которые явно не авторизованы конфигурацией ACL
BDU:2023-07323
Уязвимость сокета Unix системы управления базами данных Redis, связана с раскрытием информации в ошибочной области данных, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2024-00349
Уязвимость системы управления базами данных (СУБД) Redis, связанная с целочисленным переполнением, позволяющая нарушителю выполнить произвольный код
Modified: 2024-11-21
CVE-2023-41053
Redis is an in-memory database that persists on disk. Redis does not correctly identify keys accessed by `SORT_RO` and as a result may grant users executing this command access to keys that are not explicitly authorized by the ACL configuration. The problem exists in Redis 7.0 or newer and has been fixed in Redis 7.0.13 and 7.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6
- https://github.com/redis/redis/commit/9e505e6cd842338424e05883521ca1fb7d0f47f6
- https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc
- https://github.com/redis/redis/security/advisories/GHSA-q4jr-5p56-4xwc
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLBPIUUD273UGRN2WAYHPVUAULY36QVL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OLBPIUUD273UGRN2WAYHPVUAULY36QVL/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA4MSJ623BH6HP5UHSJD2FOTN3QM5DQS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UA4MSJ623BH6HP5UHSJD2FOTN3QM5DQS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLYNYT52EHR63E7L7SHRTHEPUMAFFDLX/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YLYNYT52EHR63E7L7SHRTHEPUMAFFDLX/
Modified: 2024-11-21
CVE-2023-41056
Redis is an in-memory database that persists on disk. Redis incorrectly handles resizing of memory buffers which can result in integer overflow that leads to heap overflow and potential remote code execution. This issue has been patched in version 7.0.15 and 7.2.4.
- https://github.com/redis/redis/releases/tag/7.0.15
- https://github.com/redis/redis/releases/tag/7.0.15
- https://github.com/redis/redis/releases/tag/7.2.4
- https://github.com/redis/redis/releases/tag/7.2.4
- https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m
- https://github.com/redis/redis/security/advisories/GHSA-xr47-pcmx-fq2m
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3JTGQJ2YLYB24B72I5B5H32YIMPVSWIT/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JTWHPLC3RI67VNRDOIXLDVNC5YMYBMQN/
- https://security.netapp.com/advisory/ntap-20240223-0003/
- https://security.netapp.com/advisory/ntap-20240223-0003/
Modified: 2024-11-21
CVE-2023-45145
Redis is an in-memory database that persists on disk. On startup, Redis begins listening on a Unix socket before adjusting its permissions to the user-provided configuration. If a permissive umask(2) is used, this creates a race condition that enables, during a short period of time, another process to establish an otherwise unauthorized connection. This problem has existed since Redis 2.6.0-RC1. This issue has been addressed in Redis versions 7.2.2, 7.0.14 and 6.2.14. Users are advised to upgrade. For users unable to upgrade, it is possible to work around the problem by disabling Unix sockets, starting Redis with a restrictive umask, or storing the Unix socket file in a protected directory.
- https://github.com/redis/redis/commit/03345ddc7faf7af079485f2cbe5d17a1611cbce1
- https://github.com/redis/redis/commit/03345ddc7faf7af079485f2cbe5d17a1611cbce1
- https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx
- https://github.com/redis/redis/security/advisories/GHSA-ghmp-889m-7cvx
- https://lists.debian.org/debian-lts-announce/2023/10/msg00032.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00032.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/464JPNBWE433ZGYXO3KN72VR3KJPWHAW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/464JPNBWE433ZGYXO3KN72VR3KJPWHAW/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNEK2K4IE7MPKRD6H36JXZMJKYS6I5GQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BNEK2K4IE7MPKRD6H36JXZMJKYS6I5GQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZMGTTV5XM4LA66FSIJSETNBBRRPJYOQ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZMGTTV5XM4LA66FSIJSETNBBRRPJYOQ/
- https://security.netapp.com/advisory/ntap-20231116-0014/
- https://security.netapp.com/advisory/ntap-20231116-0014/
Closed bugs
Ошибка запуска redis-sentinel.service
redis-sentinel не имеет прав на запись конфигурационного файла
redis перестал запускаться после обновления до 6.2.13-alt1