Все бюллетени/c10f2/ALT-PU-2026-10632-4
ALT-PU-2026-10632-4

Обновление пакета openbao в ветке c10f2

Версия2.5.5-alt1
Задание#424602
Опубликовано2026-08-01
Макс. серьёзностьHIGH
Серьёзность:

Закрытые проблемы (21)

BDU:2026-10494
MEDIUM5.3

Уязвимость системы управления секретами и шифрованием OpenBao, связанная с ошибками разграничения доступа, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2026-07-26
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
Ссылки
BDU:2026-10829
MEDIUM6.5

Уязвимость системы управления секретами и шифрованием OpenBao, связанная с недостатками контроля доступа, позволяющая нарушителю повысить свои привилегии

Опубликовано: 2026-07-30
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0СРЕДНЯЯ 6.8
CVSS:2.0/AV:N/AC:L/Au:S/C:N/I:N/A:C
Ссылки
BDU:2026-10830
MEDIUM6.7

Уязвимость системы управления секретами и шифрованием OpenBao, связанная с возникновением конфликта интерпретаций, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2026-07-30
CVSS 3.xСРЕДНЯЯ 6.7
CVSS:3.x/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0СРЕДНЯЯ 6.5
CVSS:2.0/AV:L/AC:L/Au:M/C:C/I:C/A:C
Ссылки
CVE-2026-32952
HIGH7.5

go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using `ntlmssp.Negotiator` as an HTTP transport. Version 0.1.1 patches the issue.

Опубликовано: 2026-04-24Изменено: 2026-06-17
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ссылки
CVE-2026-41889
LOW2.3

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

Опубликовано: 2026-05-08Изменено: 2026-06-17
CVSS 3.xКРИТИЧЕСКАЯ 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 4.0НИЗКАЯ 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Ссылки
CVE-2026-45808
HIGH7.1

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's namespaces provide multi-tenant separation. A tenant who intentionally leaks lease identifiers can have their lease and underlying credential revoked or renewed by a user in another tenant via the legacy, undocumented `sys/revoke` and `sys/renew` endpoints. This is fixed in OpenBao v2.5.4.

Опубликовано: 2026-08-07
CVSS 4.0ВЫСОКАЯ 7.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Ссылки
CVE-2026-46358
MEDIUM5.4

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, OpenBao's inline auth functionality incorrectly redacted audit log entries, resulting in non-auth headers being removed and auth-related headers being retained in cleartext. This requires an attacker to compromise access to the audit device. Operators should review leaked source authentication material and rotate it as appropriate. This is fixed in OpenBao v2.5.4.

Опубликовано: 2026-08-07Изменено: 2026-08-10
CVSS 4.0СРЕДНЯЯ 5.4
CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Ссылки
CVE-2026-46405
MEDIUM5.3

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.4, in OpenBao's Kerberos auth method on the `GET` handler, or when an `Authorization: Negotiate` header is supplied, the response is includes a `logical.Auth` object in addition to an error message. This results in tokens being created with only the default policy, default TTL, and no entity information, which are hidden by the returned error message. No access to these tokens by the caller occurs and the authentication token is not ever made accessible outside of `sys/raw`. This is fixed in OpenBao v2.5.4. As a workaround, users may set a rate limit quota to limit the creation of these paths. As the path is unauthenticated, it isn't possible to deny access to it.

Опубликовано: 2026-08-07
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ссылки
GHSA-6mwx-4547-5vc9
MEDIUM6.8

OpenBao: LDAPi ldaputil (wrong escape func)

Опубликовано: 2026-06-19
CVSS 3.xСРЕДНЯЯ 6.8
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Ссылки
GHSA-7j6w-vvw2-5f9c
MEDIUM5.3

OpenBao's Kerberos Auth Method Accumulates Unaccessible Tokens

Опубликовано: 2026-05-28
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Ссылки
GHSA-8w8f-r2xv-4q4j
MEDIUM6.5

OpenBao: Transit secrets engine crashes on key creation with `derived: true` for asymmetric key types

Опубликовано: 2026-06-19
CVSS 3.xСРЕДНЯЯ 6.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Ссылки
GHSA-c36x-h252-g9x2
LOW2.1

OpenBao: Cross-namespace lease revocation/renewal via canonical sys/leases/{revoke,renew} — incomplete fix of CVE-2026-45808

Опубликовано: 2026-06-19
CVSS 4.0НИЗКАЯ 2.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Ссылки
GHSA-j88v-2chj-qfwx
LOW2.3

pgx: SQL Injection via placeholder confusion with dollar quoted string literals

Опубликовано: 2026-04-22Изменено: 2026-05-13
CVSS 4.0НИЗКАЯ 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Ссылки
GHSA-mwr2-wmgp-crj6
LOW2.3

OpenBao's System Backend allows Unauthorized Management of the containing Namespace

Опубликовано: 2026-06-19
CVSS 4.0НИЗКАЯ 2.3
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Ссылки
GHSA-q8cj-789h-vg24
MEDIUM5.4

OpenBao's Inline Auth Incorrectly Redacted Headers

Опубликовано: 2026-05-28
CVSS 4.0СРЕДНЯЯ 5.4
CVSS:4.0/CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Ссылки
GHSA-v8v8-cm84-m686
HIGH7.1

OpenBao's cross-namespace lease revocation via legacy sys/revoke path bypasses ACL

Опубликовано: 2026-05-28
CVSS 4.0ВЫСОКАЯ 7.1
CVSS:4.0/CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Ссылки