ALT-BU-2025-6008-2

Branch p11 update bulletin.

Package kubernetes1.30 updated to version 1.30.10-alt1 for branch p11 in task 378611.

Уязвимость утилиты kubelet программного средства управления кластерами виртуальных машин Kubernetes для операционных систем Windows, позволяющая нарушителю выполнить произвольные команды

Severity: MEDIUM (5.9)Vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Severity: MEDIUM (6.6)Vector: AV:N/AC:H/Au:S/C:C/I:C/A:N

References:

CVE-2024-9042

Уязвимость утилиты kubelet программного средства управления кластерами виртуальных машин Kubernetes, позволяющая нарушителю вызвать отказ в облуживании

Severity: MEDIUM (6.2)Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: MEDIUM (4.9)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

References:

CVE-2025-0426

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References:

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

Severity: MEDIUM (6.2)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Node Denial of Service via kubelet Checkpoint API

Severity: MEDIUM (6.2)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References:

Package kubernetes1.31 updated to version 1.31.6-alt1 for branch p11 in task 378611.

Severity: MEDIUM (5.9)Vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Severity: MEDIUM (6.6)Vector: AV:N/AC:H/Au:S/C:C/I:C/A:N

References:

CVE-2024-9042

Severity: MEDIUM (6.2)Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: MEDIUM (4.9)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

References:

CVE-2025-0426

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References:

Severity: MEDIUM (6.2)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Node Denial of Service via kubelet Checkpoint API

Severity: MEDIUM (6.2)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References:

Package kubernetes1.29 updated to version 1.29.14-alt1 for branch p11 in task 378611.

Severity: MEDIUM (5.9)Vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

Severity: MEDIUM (6.6)Vector: AV:N/AC:H/Au:S/C:C/I:C/A:N

References:

CVE-2024-9042

Severity: MEDIUM (6.2)Vector: AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: MEDIUM (4.9)Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

References:

CVE-2025-0426

This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.

Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References:

Severity: MEDIUM (6.2)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Node Denial of Service via kubelet Checkpoint API

Severity: MEDIUM (6.2)Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API

Severity: MEDIUM (5.9)Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N

References:

Package grass updated to version 8.4.1-alt1 for branch p11 in task 379033.

Отсутствуют драйвера баз данных

Package audit updated to version 4.0.3-alt1 for branch p11 in task 379920.

Невозможно установить audit на систему без systemd

Package gpupdate updated to version 0.13.2-alt1 for branch p11 in task 377930.

Нарушение унаследования прав на сетевых ресурсах при использовании опции cifsacl

"[Errno 2] No such file or directory: '/etc/auto.master.gpupdate.d'" при выполнении gpupdate после настройки LAPS

Package zabbix updated to version 7.0.12-alt0.p11.1 for branch p11 in task 382373.

Уязвимость сервера универсальной системы мониторинга Zabbix, позволяющая нарушителю вызвать отказ в обслуживании

Severity: MEDIUM (6.5)Vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: MEDIUM (6.1)Vector: AV:A/AC:L/Au:N/C:N/I:N/A:C

References:

CVE-2024-45700

Уязвимость компонента API универсальной системы мониторинга Zabbix, позволяющая нарушителю выполнить произвольные команды

Severity: HIGH (8.0)Vector: AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: HIGH (7.7)Vector: AV:A/AC:L/Au:S/C:C/I:C/A:C

References:

CVE-2024-36465

Уязвимость веб-интейрфеса универсальной системы мониторинга Zabbix, позволяющая нарушителю провести атаку межсайтового скриптинга

Severity: HIGH (7.5)Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: HIGH (7.6)Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

References:

CVE-2024-45699

Уязвимость компонента API универсальной системы мониторинга Zabbix, позволяющая нарушителю раскрыть защищаемую информацию

Severity: LOW (3.5)Vector: AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Severity: LOW (2.7)Vector: AV:A/AC:L/Au:S/C:P/I:N/A:N

References:

CVE-2024-42325

Уязвимость сервера универсальной системы мониторинга Zabbix, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Severity: LOW (3.1)Vector: AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity: LOW (1.8)Vector: AV:A/AC:H/Au:N/C:P/I:N/A:N

References:

CVE-2024-36469

A low privilege (regular) Zabbix user with API access can use SQL injection vulnerability in include/classes/api/CApiService.php to execute arbitrary SQL commands via the groupBy parameter.

Severity: HIGH (8.8)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Severity: HIGH (8.6)Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References:

https://support.zabbix.com/browse/ZBX-26257

Execution time for an unsuccessful login differs when using a non-existing username compared to using an existing one.

Severity: LOW (3.1)Vector: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Severity: LOW (2.3)Vector: CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References:

Zabbix API user.get returns all users that share common group with the calling user. This includes media and other information, such as login attempts, etc.

Severity: LOW (3.5)Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Severity: LOW (2.1)Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References:

The endpoint /zabbix.php?action=export.valuemaps suffers from a Cross-Site Scripting vulnerability via the backurl parameter. This is caused by the reflection of user-supplied data without appropriate HTML escaping or output encoding. As a result, a JavaScript payload may be injected into the above endpoint causing it to be executed within the context of the victim's browser.

Severity: MEDIUM (5.4)Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Severity: HIGH (7.5)Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References:

Zabbix server is vulnerable to a DoS vulnerability due to uncontrolled resource exhaustion. An attacker can send specially crafted requests to the server, which will cause the server to allocate an excessive amount of memory and perform CPU-intensive decompression operations, ultimately leading to a service crash.

Severity: MEDIUM (6.5)Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Severity: MEDIUM (6.0)Vector: CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

References:

Version: 2.1.2

ALT-BU-2025-6008-2

Closed vulnerabilities

Closed vulnerabilities

Closed vulnerabilities

Closed bugs

Closed bugs

Closed bugs

Closed vulnerabilities