ALT-BU-2025-7434-1
Branch sisyphus_riscv64 update bulletin.
Package python3-module-gunicorn updated to version 23.0.0-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
BDU:2024-03553
Уязвимость WSGI-сервера gunicorn, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю обойти существующие ограничения безопасности и выполнить атаку «контрабанда HTTP-запросов»
Modified: 2024-12-20
CVE-2024-1135
Gunicorn fails to properly validate Transfer-Encoding headers, leading to HTTP Request Smuggling (HRS) vulnerabilities. By crafting requests with conflicting Transfer-Encoding headers, attackers can bypass security restrictions and access restricted endpoints. This issue is due to Gunicorn's handling of Transfer-Encoding headers, where it incorrectly processes requests with multiple, conflicting Transfer-Encoding headers, treating them as chunked regardless of the final encoding specified. This vulnerability allows for a range of attacks including cache poisoning, session manipulation, and data exposure.
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://huntr.com/bounties/22158e34-cfd5-41ad-97e0-a780773d96c1
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/06/msg00027.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00018.html
Closed bugs
Для закрытия CVE-2024-1135 необходимо обновить пакет
Package vcpkg updated to version 2025.05.19-alt1 for branch sisyphus_riscv64.
Closed bugs
Обновить до 2025.02.11 в p11
Package flacon updated to version 12.0.0-alt1.1 for branch sisyphus_riscv64.
Closed bugs
Собрать с taglib-devel
Package kf6-kio updated to version 6.14.0-alt2 for branch sisyphus_riscv64.
Closed bugs
Крашится программа при подключении к сетевому ресурсе через smb
Package forgejo-runner updated to version 6.3.1-alt2 for branch sisyphus_riscv64.
Closed bugs
В user-unit'е forgejo-runner указаны User и Group, что препятствует его запуску