All errata/sisyphus_loongarch64/ALT-PU-2025-15630-1
ALT-PU-2025-15630-1

Package update rclone in branch sisyphus_loongarch64

Version1.72.0-alt1
Task#0
Published2025-12-10
Max severityHIGH
Severity:

Closed issues (6)

BDU:2025-06560
HIGH7.5

Уязвимость SSH-сервера языка программирования Golang, связанная с неконтролируемым расходом ресурсов, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2025-06-09Modified: 2025-12-08
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2025-08472
HIGH7.5

Уязвимость функции parse.ParseUnverified() библиотеки для работы с веб-токенами golang-jwt языка программирования Go, позволяющая нарушителю раскрыть защищаемую информацию

Published: 2025-07-15Modified: 2025-12-08
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0HIGH 7.8
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:C
References
BDU:2025-14688
MEDIUM5.3

Уязвимость SSH-сервера библиотеки для языка программирования Go crypto, позволяющая нарушителю оказать воздействие на доступность защищаемой информации

Published: 2025-11-26Modified: 2026-04-15
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
References
CVE-2025-22869
HIGH7.5

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Published: 2025-02-26Modified: 2025-05-01
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References
CVE-2025-30204
HIGH7.5

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.

Published: 2025-03-21Modified: 2026-04-15
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
References