ALT-BU-2024-7711-1
Branch sisyphus_e2k update bulletin.
Package freeipa updated to version 4.11.1-alt3 for branch sisyphus_e2k.
Closed bugs
freeipa-4.11.1-alt2 не собирается с новой samba-4.20
Package postfix updated to version 3.8.6-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
BDU:2024-00106
Уязвимость демона smtpd почтового сервера Postfix, позволяющая нарушителю обойти ограничения безопасности и осуществить подмену электронных писем (атака типа SMTP Smuggling)
Modified: 2024-11-21
CVE-2023-51764
Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports
- [oss-security] 20231224 Re: Re: New SMTP smuggling attack
- [oss-security] 20231224 Re: Re: New SMTP smuggling attack
- [oss-security] 20231225 Re: Re: New SMTP smuggling attack
- [oss-security] 20231225 Re: Re: New SMTP smuggling attack
- [oss-security] 20240508 Re: New SMTP smuggling attack
- [oss-security] 20240508 Re: New SMTP smuggling attack
- https://access.redhat.com/security/cve/CVE-2023-51764
- https://access.redhat.com/security/cve/CVE-2023-51764
- https://bugzilla.redhat.com/show_bug.cgi?id=2255563
- https://bugzilla.redhat.com/show_bug.cgi?id=2255563
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- https://fahrplan.events.ccc.de/congress/2023/fahrplan/events/11782.html
- https://github.com/duy-31/CVE-2023-51764
- https://github.com/duy-31/CVE-2023-51764
- https://github.com/eeenvik1/CVE-2023-51764
- https://github.com/eeenvik1/CVE-2023-51764
- [debian-lts-announce] 20240130 [SECURITY] [DLA 3725-1] postfix security update
- [debian-lts-announce] 20240130 [SECURITY] [DLA 3725-1] postfix security update
- FEDORA-2024-5c186175f2
- FEDORA-2024-5c186175f2
- FEDORA-2024-c839e7294f
- FEDORA-2024-c839e7294f
- https://lwn.net/Articles/956533/
- https://lwn.net/Articles/956533/
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/
- https://www.openwall.com/lists/oss-security/2024/01/22/1
- https://www.openwall.com/lists/oss-security/2024/01/22/1
- https://www.postfix.org/announcements/postfix-3.8.5.html
- https://www.postfix.org/announcements/postfix-3.8.5.html
- https://www.postfix.org/smtp-smuggling.html
- https://www.postfix.org/smtp-smuggling.html
- https://www.youtube.com/watch?v=V8KPV96g1To
- https://www.youtube.com/watch?v=V8KPV96g1To
Closed bugs
Предупреждения о попытке чтения несуществующих библиотек
CVE-2023-51764 для закрытия необходимо обновление до версии 3.8.4 и старше
Package plasma5-sdk updated to version 5.27.11-alt2 for branch sisyphus_e2k.
Closed bugs
Не работает кнопка "Открыть во внешней программе" в cuttlefish
Двойное оповещение при создании нового оформления в lookandfeelexplorer
Package mkimage-profiles updated to version 1.6.4-alt1 for branch sisyphus_e2k.
Closed bugs
бессмысленный запуск ldconfig при загрузке с LiveCD
Package glib2 updated to version 2.80.2-alt1 for branch sisyphus_e2k.
Closed vulnerabilities
Modified: 2024-11-21
CVE-2024-34397
An issue was discovered in GNOME GLib before 2.78.5, and 2.79.x and 2.80.x before 2.80.1. When a GDBus-based client subscribes to signals from a trusted system service such as NetworkManager on a shared computer, other users of the same computer can send spoofed D-Bus signals that the GDBus-based client will wrongly interpret as having been sent by the trusted system service. This could lead to the GDBus-based client behaving incorrectly, with an application-dependent impact.
- https://gitlab.gnome.org/GNOME/glib/-/issues/3268
- https://gitlab.gnome.org/GNOME/glib/-/issues/3268
- [debian-lts-announce] 20240513 [SECURITY] [DLA 3814-1] glib2.0 security update
- [debian-lts-announce] 20240513 [SECURITY] [DLA 3814-1] glib2.0 security update
- FEDORA-2024-be032e564d
- FEDORA-2024-be032e564d
- FEDORA-2024-635a54eb7e
- FEDORA-2024-635a54eb7e
- FEDORA-2024-fd2569c4e9
- FEDORA-2024-fd2569c4e9
- FEDORA-2024-2ce1c754f7
- FEDORA-2024-2ce1c754f7
- https://security.netapp.com/advisory/ntap-20240531-0008/
- https://security.netapp.com/advisory/ntap-20240531-0008/
- https://www.openwall.com/lists/oss-security/2024/05/07/5
- https://www.openwall.com/lists/oss-security/2024/05/07/5
Package dcmtk updated to version 3.6.8-alt2 for branch sisyphus_e2k.
Closed bugs
Неполный -devel ломает сборку