ALT-BU-2025-7985-3
Branch p11 update bulletin.
Closed vulnerabilities
Modified: 2025-09-30
BDU:2025-09086
Уязвимость сервера системы управления базами данных MongoDB, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2025-09087
Уязвимость сервера системы управления базами данных MongoDB, позволяющая нарушителю вызвать отказ в обслуживании
BDU:2026-02957
Уязвимость системы управления базами данных MongoDB, связанная с недостаточной проверкой необычных или исключительных состояний, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2025-12-12
CVE-2025-12657
The KMIP response parser built into mongo binaries is overly tolerant of certain malformed packets, and may parse them into invalid objects. Later reads of this object can result in read access violations.
Modified: 2025-10-03
CVE-2025-6712
MongoDB Server may be susceptible to disruption caused by high memory usage, potentially leading to server crash. This condition is linked to inefficiencies in memory management related to internal operations. In scenarios where certain internal processes persist longer than anticipated, memory consumption can increase, potentially impacting server stability and availability. This issue affects MongoDB Server v8.0 versions prior to 8.0.10
Modified: 2025-10-03
CVE-2025-6714
MongoDB Server's mongos component can become unresponsive to new connections due to incorrect handling of incomplete data. This affects MongoDB when configured with load balancer support. This issue affects MongoDB Server v6.0 prior to 6.0.23, MongoDB Server v7.0 prior to 7.0.20 and MongoDB Server v8.0 prior to 8.0.9 Required Configuration: This affects MongoDB sharded clusters when configured with load balancer support for mongos using HAProxy on specified ports.
Closed bugs
rasdaemon.env: No such file or directory
rasdaemon.env: No such file or directory
Package apt-indicator updated to version 0.4.2-alt1 for branch p11 in task 383901.
Closed bugs
В GUI отсутствует ограничение на максимальный размер интервала для каждого типа
apt-indicator использует /usr/bin/xdg-su
Package spawn-fcgi updated to version 1.6.5-alt2 for branch p11 in task 385369.
Closed bugs
Неправильная генерация spawn-fcgi.service
Closed bugs
control: grep: warning: * at start of expression
Closed bugs
Скрыть значок запуска
Closed vulnerabilities
Modified: 2026-01-08
CVE-2025-47711
There's a flaw in the nbdkit server when handling responses from its plugins regarding the status of data blocks. If a client makes a specific request for a very large data range, and a plugin responds with an even larger single block, the nbdkit server can encounter a critical internal error, leading to a denial-of-service.
Modified: 2026-01-08
CVE-2025-47712
A flaw exists in the nbdkit "blocksize" filter that can be triggered by a specific type of client request. When a client requests block status information for a very large data range, exceeding a certain limit, it causes an internal error in the nbdkit, leading to a denial of service.
Closed vulnerabilities
BDU:2024-07712
Уязвимость обратного прокси сервера Containous Traefik, связанная с недостаточной проверкой подлинности данных, позволяющая нарушителю выполнить произвольный код
BDU:2026-00344
Уязвимость обратного прокси сервера Containous Traefik, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю раскрыть защищаемую информацию
Modified: 2024-09-25
CVE-2024-45410
Traefik is a golang, Cloud Native Application Proxy. When a HTTP request is processed by Traefik, certain HTTP headers such as X-Forwarded-Host or X-Forwarded-Port are added by Traefik before the request is routed to the application. For a HTTP client, it should not be possible to remove or modify these headers. Since the application trusts the value of these headers, security implications might arise, if they can be modified. For HTTP/1.1, however, it was found that some of theses custom headers can indeed be removed and in certain cases manipulated. The attack relies on the HTTP/1.1 behavior, that headers can be defined as hop-by-hop via the HTTP Connection header. This issue has been addressed in release versions 2.11.9 and 3.1.3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Modified: 2025-11-25
CVE-2024-52003
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. There is a vulnerability in Traefik that allows the client to provide the X-Forwarded-Prefix header from an untrusted source. This issue has been addressed in versions 2.11.14 and 3.2.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Modified: 2025-11-25
CVE-2025-32431
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path.
Modified: 2025-11-25
CVE-2025-47952
Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. Prior to versions 2.11.25 and 3.4.1, there is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a URL encoded string in its path, it’s possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.25 and 3.4.1.
Modified: 2024-09-25
GHSA-62c8-mh53-4cqv
HTTP client can manipulate custom HTTP headers that are added by Traefik
- https://github.com/traefik/traefik/security/advisories/GHSA-62c8-mh53-4cqv
- https://nvd.nist.gov/vuln/detail/CVE-2024-45410
- https://github.com/traefik/traefik/commit/584144100524277829f26219baaab29a53b8134f
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.9
- https://github.com/traefik/traefik/releases/tag/v3.1.3
Modified: 2025-11-27
GHSA-6p68-w45g-48j7
Traefik has a possible vulnerability with its path matchers
- https://github.com/traefik/traefik/security/advisories/GHSA-6p68-w45g-48j7
- https://nvd.nist.gov/vuln/detail/CVE-2025-32431
- https://github.com/traefik/traefik/pull/11684
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.24
- https://github.com/traefik/traefik/releases/tag/v3.3.6
- https://github.com/traefik/traefik/releases/tag/v3.4.0-rc2
Modified: 2025-11-27
GHSA-h924-8g65-j9wg
Traefik's X-Forwarded-Prefix Header still allows for Open Redirect
- https://github.com/traefik/traefik/security/advisories/GHSA-h924-8g65-j9wg
- https://nvd.nist.gov/vuln/detail/CVE-2024-52003
- https://github.com/traefik/traefik/pull/11253
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.14
- https://github.com/traefik/traefik/releases/tag/v3.2.1
Modified: 2025-11-27
GHSA-vrch-868g-9jx5
Traefik allows path traversal using url encoding
- https://github.com/traefik/traefik/security/advisories/GHSA-vrch-868g-9jx5
- https://nvd.nist.gov/vuln/detail/CVE-2025-47952
- https://github.com/traefik/traefik/commit/08d5dfee0164aa54dd44a467870042e18e8d3f00
- https://github.com/traefik/traefik
- https://github.com/traefik/traefik/releases/tag/v2.11.25
- https://github.com/traefik/traefik/releases/tag/v3.4.1
Closed bugs
Steam не авторизует сертификат CA
Отсутствует явная зависимость на xorg-xwayland
Closed vulnerabilities
Modified: 2026-04-15
CVE-2024-52522
Rclone is a command-line program to sync files and directories to and from different cloud storage providers. Insecure handling of symlinks with --links and --metadata in rclone while copying to local disk allows unprivileged users to indirectly modify ownership and permissions on symlink target files when a superuser or privileged process performs a copy. This vulnerability could enable privilege escalation and unauthorized access to critical system files, compromising system integrity, confidentiality, and availability. This vulnerability is fixed in 1.68.2.
Closed bugs
Обновить rclone
Package branding-alt-education updated to version 11.0-alt1 for branch p11 in task 386750.
Closed bugs
Убрать зависимость на beesu
