ALT-BU-2025-7993-1
Branch sisyphus_riscv64 update bulletin.
Package python3-module-django updated to version 5.2.2-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-10-24
BDU:2025-06450
Уязвимость функции django.utils.log.log_response() программной платформы для веб-приложений Django, позволяющая нарушителю получить доступ на изменение данных в журнале
Modified: 2025-10-15
CVE-2025-48432
An issue was discovered in Django 5.2 before 5.2.3, 5.1 before 5.1.11, and 4.2 before 4.2.23. Internal HTTP response logging does not escape request.path, which allows remote attackers to potentially manipulate log output via crafted URLs. This may lead to log injection or forgery when logs are viewed in terminals or processed by external systems.
- https://docs.djangoproject.com/en/dev/releases/security/
- https://groups.google.com/g/django-announce
- https://www.djangoproject.com/weblog/2025/jun/04/security-releases/
- https://www.djangoproject.com/weblog/2025/jun/10/bugfix-releases/
- http://www.openwall.com/lists/oss-security/2025/06/04/5
- http://www.openwall.com/lists/oss-security/2025/06/10/2
- http://www.openwall.com/lists/oss-security/2025/06/10/3
- http://www.openwall.com/lists/oss-security/2025/06/10/4
Package libisc-export-dhcp updated to version 9.11.36-alt2 for branch sisyphus_riscv64.
Closed vulnerabilities
Modified: 2025-07-07
BDU:2022-05754
Уязвимость сервера DNS BIND, связанная с недостатками обработки HTTP-запросов, позволяющая нарушителю оказать воздействие на целостность данных
Modified: 2024-11-21
CVE-2021-25220
BIND 9.11.0 -> 9.11.36 9.12.0 -> 9.16.26 9.17.0 -> 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 -> 9.11.36-S1 9.16.8-S1 -> 9.16.26-S1 Versions of BIND 9 earlier than those shown - back to 9.1.0, including Supported Preview Editions - are also believed to be affected but have not been tested as they are EOL. The cache could become poisoned with incorrect records leading to queries being made to the wrong servers, which might also result in false information being returned to clients.
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- https://kb.isc.org/v1/docs/cve-2021-25220
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VX3I2U3ICOIEI5Y7OYA6CHOLFMNH3YQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/API7U5E7SX7BAAVFNW366FFJGD6NZZKV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DE3UAVCPUMAKG27ZL5YXSP2C3RIOW3JZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
- https://security.gentoo.org/glsa/202210-25
- https://security.netapp.com/advisory/ntap-20220408-0001/
- https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US
- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
- https://kb.isc.org/v1/docs/cve-2021-25220
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2SXT7247QTKNBQ67MNRGZD23ADXU6E5U/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5VX3I2U3ICOIEI5Y7OYA6CHOLFMNH3YQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/API7U5E7SX7BAAVFNW366FFJGD6NZZKV/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DE3UAVCPUMAKG27ZL5YXSP2C3RIOW3JZ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/
- https://security.gentoo.org/glsa/202210-25
- https://security.netapp.com/advisory/ntap-20220408-0001/
- https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-SRX-Series-Cache-poisoning-vulnerability-in-BIND-used-by-DNS-Proxy-CVE-2021-25220?language=en_US
Package docs-alt-workstation updated to version 11.0-alt5 for branch sisyphus_riscv64.
Closed bugs
Исправить опечатки в документации docs-alt-workstation