ALT-BU-2025-15139-1
Branch sisyphus update bulletin.
Closed vulnerabilities
Modified: 2025-12-05
CVE-2025-11411
NLnet Labs Unbound up to and including version 1.24.1 is vulnerable to possible domain hijack attacks. Promiscuous NS RRSets that complement positive DNS replies in the authority section can be used to trick resolvers to update their delegation information for the zone. Usually these RRSets are used to update the resolver's knowledge of the zone's name servers. A malicious actor can exploit the possible poisonous effect by injecting NS RRSets (and possibly their respective address records) in a reply. This could be done for example by trying to spoof a packet or fragmentation attacks. Unbound would then proceed to update the NS RRSet data it already has since the new data has enough trust for it, i.e., in-zone data for the delegation point. Unbound 1.24.1 includes a fix that scrubs unsolicited NS RRSets (and their respective address records) from replies mitigating the possible poison effect. Unbound 1.24.2 includes an additional fix that scrubs unsolicited NS RRSets (and their respective address records) from YXDOMAIN and non-referral nodata replies, further mitigating the possible poison effect.
Package docs-alt-domain updated to version 11.0-alt3 for branch sisyphus in task 401154.
Closed bugs
Клиент не получает IP-адреса после настройки DHCP-сервера для обновления DNS-записей
[FR] Изменить формулировку или изменить способ просмотра пользователей
Package emacs-mode-auctex updated to version 14.1.0-alt1 for branch sisyphus in task 400496.
Closed bugs
move /usr/share/texmf/tex/latex/preview/* to texmf-latex-preview
Closed bugs
Для работы требует ModemManager
Closed bugs
Много лишних зависимостей
Closed vulnerabilities
Modified: 2025-12-08
BDU:2025-06560
Уязвимость SSH-сервера языка программирования Golang, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-12-08
BDU:2025-08472
Уязвимость функции parse.ParseUnverified() библиотеки для работы с веб-токенами golang-jwt языка программирования Go, позволяющая нарушителю раскрыть защищаемую информацию
BDU:2025-14688
Уязвимость SSH-сервера библиотеки для языка программирования Go crypto, позволяющая нарушителю оказать воздействие на доступность защищаемой информации
Modified: 2025-05-01
CVE-2025-22869
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
Modified: 2025-04-10
CVE-2025-30204
golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.
Modified: 2025-12-11
CVE-2025-58181
SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.
Closed bugs
Ошибка работы сервиса при установке модуля tls
Closed vulnerabilities
Modified: 2025-12-04
CVE-2025-58436
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a client that connects to cupsd but sends slow messages, e.g. only one byte per second, delays cupsd as a whole, such that it becomes unusable by other clients. This issue has been patched in version 2.4.15.
- https://github.com/OpenPrinting/cups/commit/40008d76a001babbb9beb9d9d74b01a86fb6ddb4
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.15
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-8wpw-vfgm-qrrr
- http://www.openwall.com/lists/oss-security/2025/11/27/4
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-8wpw-vfgm-qrrr
Modified: 2025-12-04
CVE-2025-61915
OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to version 2.4.15, a user in the lpadmin group can use the cups web ui to change the config and insert a malicious line. Then the cupsd process which runs as root will parse the new config and cause an out-of-bound write. This issue has been patched in version 2.4.15.
- https://github.com/OpenPrinting/cups/commit/db8d560262c22a21ee1e55dfd62fa98d9359bcb0
- https://github.com/OpenPrinting/cups/releases/tag/v2.4.15
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc
- http://www.openwall.com/lists/oss-security/2025/11/27/5
- https://github.com/OpenPrinting/cups/security/advisories/GHSA-hxm8-vfpq-jrfc
Package openuds-server updated to version 4.0.0-alt5 for branch sisyphus in task 401242.
Closed bugs
500-ая ошибка при добавлении связанного клона Proxmox