ALT-PU-2025-9323-3

Package update opensearch in branch sisyphus

Version3.1.0-alt1

Published2026-02-04

Max severityHIGH

Severity:

Closed issues (3)

HIGH7.5

Уязвимость механизма PSL validation клиентского модуля Apache HttpClient средства Apache HttpComponents, позволяющая нарушителю осуществить CSRF-атаку

Published: 2025-04-28

CVSS 3.xHIGH 7.5

CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVSS 2.0HIGH 7.8

CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:C/A:N

References

CVE-2025-27820

HIGH7.5

A bug in PSL validation logic in Apache HttpClient 5.4.x disables domain checks, affecting cookie management and host name verification. Discovered by the Apache HttpClient team. Fixed in the 5.4.3 release

Published: 2025-04-24Modified: 2025-07-16

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

GHSA-73m2-qfq3-56cx

HIGH7.5

Apache HttpClient disables domain checks

Published: 2025-04-24Modified: 2025-05-17

CVSS 3.xHIGH 7.5

CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References