ALT-PU-2025-9323-2
Package opensearch updated to version 3.1.0-alt1 for branch sisyphus in task 388460.
Closed vulnerabilities
Published: 2025-03-06
BDU:2025-05017
Уязвимость механизма PSL validation клиентского модуля Apache HttpClient средства Apache HttpComponents, позволяющая нарушителю осуществить CSRF-атаку
Severity: HIGH (7.5)
Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Severity: HIGH (7.8)
Vector: AV:N/AC:L/Au:N/C:N/I:C/A:N
References:
Published: 2025-04-24
Modified: 2025-07-16
Modified: 2025-07-16
CVE-2025-27820
A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References: