All errata/sisyphus_riscv64/ALT-PU-2026-21836-1
ALT-PU-2026-21836-1

Package update freeipa in branch sisyphus_riscv64

Version4.13.5-alt1
Task#0
Published2026-11-10
Max severityMEDIUM
Severity:

Closed issues (2)

CVE-2026-53683
MEDIUM4.3

reset_password.html parses query string parameters and uses the 'url' parameter as a redirection target (window.location = url) after password reset, optionally delayed by a 'delay' parameter. No validation or allowlisting is performed on url, enabling an attacker to redirect users to an arbitrary external site after completion of the password-reset workflow.

Published: 2026-09-02Modified: 2026-11-05
CVSS 3.xMEDIUM 4.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Closed bugs (1)

make it unambiguous which PKI implementation is supported