ALT-PU-2022-4082-1

Обновление пакета python3 в ветке sisyphus_e2k

Версия3.10.2-alt1.1
Задание#0
Опубликовано2022-02-20
Макс. серьёзностьMEDIUM
Серьёзность:

Закрытые проблемы (1)

CVE-2013-0340
MEDIUM6.8

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Опубликовано: 2014-01-21Изменено: 2026-04-29
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:M/Au:N/C:P/I:P/A:P
Ссылки

Закрытые ошибки (2)

Статический билд python3 ломает сборку пакетов, предлагая им линковаться с libpython3.9.a