ALT-BU-2026-1184-2
Branch c10f2 update bulletin.
Package forgejo-runner updated to version 12.3.1-alt1 for branch c10f2 in task 403875.
Closed bugs
В user-unit'е forgejo-runner указаны User и Group, что препятствует его запуску
Closed vulnerabilities
Modified: 2026-04-20
BDU:2025-16242
Уязвимость функции HostnameError.Error() пакета crypto/x509 языка программирования Go, позволяющая нарушителю вызвать отказ в обслуживании
Modified: 2026-04-20
BDU:2026-00268
Уязвимость языка программирования Go, связанная с недостатками процедуры авторизации, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации
Modified: 2025-12-18
CVE-2025-61727
An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com.
Modified: 2025-12-19
CVE-2025-61729
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
GHSA-mjcp-gpgx-ggcg
OpenTofu incorrectly validates excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs