All errata/sisyphus/ALT-PU-2026-4554-3
ALT-PU-2026-4554-3

Package update mimir in branch sisyphus

Version3.0.4-alt1
Task#411504
Published2026-03-28
Max severityHIGH
Severity:

Closed issues (12)

BDU:2026-04122
LOW2.5

Уязвимость функций File.ReadDir() и File.Readdir() языка программирования Go, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Published: 2026-03-27Modified: 2026-04-16
CVSS 3.xLOW 2.5
CVSS:3.x/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0LOW 1.0
CVSS:2.0/AV:L/AC:H/Au:S/C:P/I:N/A:N
References
BDU:2026-04124
HIGH7.5

Уязвимость языка программирования Go, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю оказать воздействие на доступность защищаемой информации

Published: 2026-03-27
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-04126
MEDIUM5.9

Уязвимость языка программирования Go, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2026-03-27
CVSS 3.xMEDIUM 5.9
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0MEDIUM 5.4
CVSS:2.0/AV:N/AC:H/Au:N/C:N/I:N/A:C
References
BDU:2026-04127
HIGH7.5

Уязвимость функции url.Parse() компонента host/authority языка программирования Go, позволяющая нарушителю выполнить произвольный код

Published: 2026-03-27Modified: 2026-04-16
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2026-04129
MEDIUM6.1

Уязвимость модуля html/template языка программирования Go, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS)

Published: 2026-03-27Modified: 2026-04-16
CVSS 3.xMEDIUM 6.1
CVSS:3.x/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0MEDIUM 6.4
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:N
References
CVE-2026-24051
HIGH7.0

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking (Untrusted Search Paths) on macOS/Darwin systems. The resource detection code in sdk/resource/host_id.go executes the ioreg system command using a search path. An attacker with the ability to locally modify the PATH environment variable can achieve Arbitrary Code Execution (ACE) within the context of the application. A fix was released with v1.40.0.

Published: 2026-02-02Modified: 2026-02-27
CVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
CVE-2026-27137
HIGH7.5

When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.

Published: 2026-03-06Modified: 2026-04-21
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-27138
MEDIUM5.9

Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints. This can crash programs that are either directly verifying X.509 certificate chains, or those that use TLS.

Published: 2026-03-06Modified: 2026-04-21
CVSS 3.xMEDIUM 5.9
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2026-27139
LOW2.5

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Published: 2026-03-06Modified: 2026-04-21
CVSS 3.xLOW 2.5
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
References
CVE-2026-27142
MEDIUM6.1

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

Published: 2026-03-06Modified: 2026-04-21
CVSS 3.xMEDIUM 6.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
GHSA-9h8m-3fm2-qjrq
HIGH7.0

OpenTelemetry Go SDK Vulnerable to Arbitrary Code Execution via PATH Hijacking

Published: 2026-02-02Modified: 2026-02-28
CVSS 3.xHIGH 7.0
CVSS:3.x/CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References