ALT-BU-2024-4205-1
Branch sisyphus_riscv64 update bulletin.
Package admc updated to version 0.16.0-alt1 for branch sisyphus_riscv64.
Closed bugs
Не показывается constucted атрибут
[admc] Некорректно меняется иконка связи групповой политики, привязанной домену
Package golang updated to version 1.22.1-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2024-02034
Уязвимость пакета golang операционной системы Debian GNU/Linux, позволяющая нарушителю получить доступ к конфиденциальной информации
BDU:2024-02047
Уязвимость пакета golang операционной системы Debian GNU/Linux, позволяющая нарушителю вызвать отказ в обслуживании (DoS)
BDU:2024-02048
Уязвимость пакета golang операционной системы Debian GNU/Linux, позволяющая нарушителю вызвать отказ в обслуживании (DoS)
Modified: 2024-11-21
CVE-2023-45289
When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorization header, but a redirect to bar.com will not. A maliciously crafted HTTP redirect could cause sensitive headers to be unexpectedly forwarded.
- http://www.openwall.com/lists/oss-security/2024/03/08/4
- http://www.openwall.com/lists/oss-security/2024/03/08/4
- https://go.dev/cl/569340
- https://go.dev/cl/569340
- https://go.dev/issue/65065
- https://go.dev/issue/65065
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://pkg.go.dev/vuln/GO-2024-2600
- https://pkg.go.dev/vuln/GO-2024-2600
- https://security.netapp.com/advisory/ntap-20240329-0006/
- https://security.netapp.com/advisory/ntap-20240329-0006/
Modified: 2024-11-21
CVE-2023-45290
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines.
- http://www.openwall.com/lists/oss-security/2024/03/08/4
- http://www.openwall.com/lists/oss-security/2024/03/08/4
- https://go.dev/cl/569341
- https://go.dev/cl/569341
- https://go.dev/issue/65383
- https://go.dev/issue/65383
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://pkg.go.dev/vuln/GO-2024-2599
- https://pkg.go.dev/vuln/GO-2024-2599
- https://security.netapp.com/advisory/ntap-20240329-0004/
- https://security.netapp.com/advisory/ntap-20240329-0004/
Modified: 2024-11-21
CVE-2024-24783
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
- http://www.openwall.com/lists/oss-security/2024/03/08/4
- http://www.openwall.com/lists/oss-security/2024/03/08/4
- https://go.dev/cl/569339
- https://go.dev/cl/569339
- https://go.dev/issue/65390
- https://go.dev/issue/65390
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
- https://pkg.go.dev/vuln/GO-2024-2598
- https://pkg.go.dev/vuln/GO-2024-2598
- https://security.netapp.com/advisory/ntap-20240329-0005/
- https://security.netapp.com/advisory/ntap-20240329-0005/
Package nmap updated to version 7.94-alt3 for branch sisyphus_riscv64.
Closed bugs
zenmap требует не нужный ему пакет python3-module-pyobject