ALT-PU-2026-2727-1

Обновление пакета portainer-agent в ветке sisyphus_riscv64

Версия2.33.7-alt1
Задание#0
Опубликовано2026-02-12
Макс. серьёзностьCRITICAL
Серьёзность:

Закрытые проблемы (8)

BDU:2025-14682
MEDIUM5.3

Уязвимость сервера агента ssh-agent библиотеки для языка программирования Go crypto, позволяющая нарушителю вызвать отказ в обслуживании

Опубликовано: 2025-11-26Изменено: 2026-04-15
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
Ссылки
BDU:2025-14688
MEDIUM5.3

Уязвимость SSH-сервера библиотеки для языка программирования Go crypto, позволяющая нарушителю оказать воздействие на доступность защищаемой информации

Опубликовано: 2025-11-26Изменено: 2026-04-15
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0СРЕДНЯЯ 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:N/I:N/A:P
Ссылки
CVE-2025-47914
MEDIUM5.3

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Опубликовано: 2025-11-19Изменено: 2025-12-11
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2025-58181
MEDIUM5.3

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Опубликовано: 2025-11-19Изменено: 2025-12-11
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2025-61726
HIGH7.5

The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.

Опубликовано: 2026-01-28Изменено: 2026-02-06
CVSS 3.xВЫСОКАЯ 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2025-68121
CRITICAL10.0

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.

Опубликовано: 2026-02-05Изменено: 2026-04-29
CVSS 3.xКРИТИЧЕСКАЯ 10.0
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
GHSA-f6x5-jh6r-wrfv
MEDIUM5.3

golang.org/x/crypto/ssh/agent vulnerable to panic if message is malformed due to out of bounds read

Опубликовано: 2025-11-20Изменено: 2025-11-20
CVSS 3.xСРЕДНЯЯ 5.3
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L