Сетевые службы: уязвимости стека · Страница 3

Client-Side Memory Leak in OCSP Response Checking

Issue summary: A malicious TLS server can cause a memory leak in a TLS client that has enabled OCSP response checking by sending an OCSP response that contains no single response entries. Impact summary: An attacker can leak an attacker-tunable amount of memory per TLS handshake in a victim client application. A long-running client that repeatedly connects to a malicious server can have its memory exhausted, resulting in a Denial of Service. CWE: CWE-401: Missing Release of Memory after Effective Lifetime Description: The affected function is called during X.509 certificate chain verification when OCSP response checking is enabled with the

• Обновитесь до 3.6.4
• Обновитесь до 3.6.4-1
• Обновитесь до 4.0.2

CoreDNS: rewrite-plugin EDNS0 response-revert nil-pointer panic (remote DoS) when a downstream plugin returns a response with no OPT record

CoreDNS is a DNS server written in Go. Prior to 1.14.5, the CoreDNS rewrite plugin supports edns0 rewrite rules with an optional revert flag, and two response rules, edns0SetResponseRule and edns0ReplaceResponseRule[T] in plugin/rewrite/edns0.go, call res.IsEdns0() and immediately dereference the returned *dns.OPT without a nil check when a downstream plugin returns a response with no OPT record. A remote, unauthenticated client can send a single ordinary DNS query matching a rewrite edns0 <local|nsid|subnet> <set|append|replace> ... revert rule, causing ResponseReverter in plugin/rewrite/reverter.go to panic, return SERVFAIL, and degrade ava

CoreDNS: proxyproto plugin panics on PPv2 datagram with non-UDP transport — single 28-byte packet remote DoS

CoreDNS is a DNS server written in Go. Prior to 1.14.4, a single 28-byte UDP datagram can crash the CoreDNS process when the proxyproto plugin is enabled because plugin/pkg/proxyproto/proxyproto.go PacketConn.ReadFrom handles a PROXY v2 header with non-UDP transport such as family byte 0x11, reassigns addr from a nil readFrom result after parseProxyProtocol errors, and calls addr.String() in the warning log before ServeDNS recovery applies. This issue is fixed in version 1.14.4.

CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin

CoreDNS is a DNS server written in Go. From 1.9.4 until 1.14.5, a network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports; plugin/kubernetes/object/endpoint.go creates Port: -1, plugin/k8s_external/msg_to_dns.go skips that service, plugin/k8s_external/transfer.go sends an empty []dns.RR batch, and plugin/transfer/transfer.go indexes records[0] without checking the batch is non-empty. This issue is fixed in version 1.14.5.

CVE-2026-60002

ssh in OpenSSH before 10.4 can have a use-after-free when a server changes its host key during a key re-exchange. (This outcome occurs only on the client side.)

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:8.9p1-3ubuntu0.16
• Обновитесь до 1:8.9p1-3ubuntu0.16+Fips3

CVE-2026-60001

sshd in OpenSSH before 10.4 does not always honor the minimum authentication delay.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:8.2p1-4ubuntu0.13+esm3
• Обновитесь до 1:8.9p1-3ubuntu0.16

CVE-2026-60000

sshd in OpenSSH before 10.4 allows remote attackers to cause a denial of service (resource consumption from excessive authentication attempts) because MaxAuthTries was mishandled for GSSAPIAuthentication.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:6.6p1-2ubuntu2.13+esm4
• Обновитесь до 1:7.2p2-4ubuntu2.10+esm10
• Обновитесь до 1:7.6p1-4ubuntu0.7+esm6
• Обновитесь до 1:8.2p1-4ubuntu0.13+esm3

CVE-2026-59999

In sshd in OpenSSH before 10.4, DisableForwarding=yes was supposed to take precedence over PermitTunnel=yes, but did not.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:7.6p1-4ubuntu0.7+esm6
• Обновитесь до 1:8.2p1-4ubuntu0.13+esm3
• Обновитесь до 1:8.9p1-3ubuntu0.16

CVE-2026-59998

sshd in OpenSSH before 10.4 has an undocumented security-relevant behavior: GSSAPIStrictAcceptorCheck has no value if the server is in Windows Active Directory.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:6.6p1-2ubuntu2.13+esm4
• Обновитесь до 1:7.2p2-4ubuntu2.10+esm10
• Обновитесь до 1:7.6p1-4ubuntu0.7+esm6
• Обновитесь до 1:8.2p1-4ubuntu0.13+esm3

CVE-2026-59997

internal-sftp in sshd in OpenSSH before 10.4 recognizes only the first 9 command-line arguments, which can be important if a later command-line argument would have helped to ensure the intended security properties of an SFTP connection.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:6.6p1-2ubuntu2.13+esm4
• Обновитесь до 1:7.2p2-4ubuntu2.10+esm10
• Обновитесь до 1:7.6p1-4ubuntu0.7+esm6
• Обновитесь до 1:8.2p1-4ubuntu0.13+esm3

CVE-2026-59996

scp in OpenSSH before 10.4 may place a file in the parent directory of an intended directory when the copy occurs between two remote destinations.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:8.9p1-3ubuntu0.16
• Обновитесь до 1:8.9p1-3ubuntu0.16+Fips3

CVE-2026-59995

sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker-controlled server.

• Обновитесь до 10.4
• Обновитесь до 1:10.4p1-1
• Обновитесь до 1:6.6p1-2ubuntu2.13+esm4
• Обновитесь до 1:7.2p2-4ubuntu2.10+esm10
• Обновитесь до 1:7.6p1-4ubuntu0.7+esm6
• Обновитесь до 1:8.2p1-4ubuntu0.13+esm3

Heap Use-After-Free in the PKCS7_verify() Function

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification. Impact summary: A use-after-free may result in process crashes, heap corruption, or potentially remote code execution. When processing a PKCS#7 or S/MIME signed message, if the SignedData digestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may incorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent use of the BIO by the calling application results in a use-after-free condition. In the common case this occurs when the application later calls BIO_free() on the BIO originally pass

• Обновитесь до 1.0.1f-1ubuntu2.27+esm14
• Обновитесь до 1.0.2g-1ubuntu4.20+esm16
• Обновитесь до 1.0.2n-1ubuntu5.13+esm5
• Обновитесь до 1.0.2zq
• Обновитесь до 1.1.1-1ubuntu2.1~18.04.23+esm9
• Обновитесь до 1.1.1-1ubuntu2.fips.2.1~18.04.23.9
• Обновитесь до 1.1.1zh
• Обновитесь до 3.0.20-1~deb12u2
• Обновитесь до 3.0.21
• Обновитесь до 3.4.6
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1

Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes

Issue summary: The implementations of AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) mishandle the authentication of AAD (Additional Authenticated Data) with an empty ciphertext allowing a forgery of such messages. Impact summary: An attacker can forge empty messages with arbitrary AAD to the victim's application using these ciphers. AES-SIV (RFC 5297) and AES-GCM-SIV (RFC 8452) are nonce-misuse-resistant AEAD modes: they accept a key, nonce, optional AAD (bytes that are authenticated but not encrypted), and plaintext, and produces ciphertext plus a 16-byte tag. On decrypt, `EVP_DecryptFinal_ex()` is documented to return success only if the

• Обновитесь до 3.0.13-0ubuntu3.11
• Обновитесь до 3.0.13-0ubuntu3.12+Fips1
• Обновитесь до 3.0.2-0ubuntu1.25
• Обновитесь до 3.0.2-0ubuntu1.25+Fips1
• Обновитесь до 3.0.20-1~deb12u2
• Обновитесь до 3.0.21
• Обновитесь до 3.4.6
• Обновитесь до 3.5.3-1ubuntu3.4
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1

AES-OCB IV Ignored on EVP_Cipher() Path

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded. Impact summary: Every message encrypted under the same key uses the same effective nonce regardless of the IV supplied by the caller, resulting in (key, nonce) reuse and loss of confidentiality. If the same code path is used to compute the authentication tag, the tag depends only on the (key, IV) pair and not on the plaintext or ciphertext, allowing universal forgery of arbitrary ciphertext from a single captured message. OpenSSL provides two ways to driv

• Обновитесь до 3.0.13-0ubuntu3.11
• Обновитесь до 3.0.13-0ubuntu3.12+Fips1
• Обновитесь до 3.0.2-0ubuntu1.25
• Обновитесь до 3.0.2-0ubuntu1.25+Fips1
• Обновитесь до 3.0.20-1~deb12u2
• Обновитесь до 3.0.21
• Обновитесь до 3.4.6
• Обновитесь до 3.5.3-1ubuntu3.4
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1

Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email()

Issue summary: When the X509_VERIFY_PARAM_set1_email is called by an application to validate a crafted e-mail address, such as during S/MIME message validation, an out of bounds read can happen. Impact summary: This out of bounds read will not directly exfiltrate the data read to the attacker so the most likely result is a crash and a Denial of Service. An internal helper function called from X509_VERIFY_PARAM_[set|add]_email() used a wrong length when validating the local part of an email address. This could cause the 64 octet limit on the local part of an email address to be not enforced, or cause an out of bound read and potentially a cr

• Обновитесь до 4.0.1

FFC-DH Peer Validation Uses Attacker-Supplied q

Issue summary: When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the peer key is not properly checked for the subgroup membership. Impact summary: A malicious peer which presents an X9.42 key carrying the victim's p and g parameters, a forged q = r (a small prime factor of the cofactor (p−1)/q_local), and a public value Y of order r can recover the victim's private key after a small number of key exchange attempts. When EVP_PKEY_derive_set_peer() is called with a DHX (X9.42) peer key, the subgroup membership check Y^q ≡ 1 (mod p) is performed using the peer's own q parameter, not the local key's q. The peer's domain par

• Обновитесь до 3.0.13-0ubuntu3.11
• Обновитесь до 3.0.13-0ubuntu3.12+Fips1
• Обновитесь до 3.0.2-0ubuntu1.25
• Обновитесь до 3.0.2-0ubuntu1.25+Fips1
• Обновитесь до 3.0.20-1~deb12u2
• Обновитесь до 3.0.21
• Обновитесь до 3.4.6
• Обновитесь до 3.5.3-1ubuntu3.4
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1

Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate

Issue Summary: An error in the callback used to verify the certificate provided in a Root CA key update Certificate Management Protocol (CMP) message response rendered the certificate validation ineffectual, which could lead to escalation of credentials from the Registration Authority (RA) level to the root Certification Authority (root CA) level. Impact Summary: The Registration Autority could replace the root CA certificate for the CMP clients with an arbitrary root CA certificate. One of the parts of the Certificate Management Protocol (CMP), specified in RFC 9810, is Root Certification Authority (root CA) key Rollover, which is sent by

• Обновитесь до 3.4.6
• Обновитесь до 3.5.3-1ubuntu3.4
• Обновитесь до 3.5.5-1ubuntu3.2
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1

Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()

Issue summary: The CMS_decrypt and PKCS7_decrypt functions are vulnerable to Bleichenbacher-style attack when an attacker is able to provide the CMS or S/MIME messages and observe the error code and/or decryption output. Impact summary: The Bleichenbacher-style attack allows an attacker to use the victim's vulnerable application as a way to decrypt or sign messages with the victim's private RSA key. The attack is possible in 2 variants. 1. The decryption API (CMS_decrypt(), PKCS7_decrypt()) is used without providing the recipient certificate. In this case OpenSSL iterates over every KeyTransRecipientInfo (KTRI) without stopping at the firs

• Обновитесь до 3.4.6
• Обновитесь до 3.5.3-1ubuntu3.4
• Обновитесь до 3.5.5-1ubuntu3.2
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1

NULL Pointer Dereference in CRMF EncryptedValue Decryption

Issue summary: An attacker-controlled CMP (Certificate Management Protocol) server could trigger a NULL pointer dereference in a CMP client application. Impact summary: A NULL pointer dereference causes a crash of the application and a Denial of Service. An attacker controlling a CMP server (or acting as a man-in-the-middle) could craft a CMP response containing a CRMF (Certificate Request Message Format) CertRepMessage with an EncryptedValue structure where the symmAlg field has an algorithm OID but no parameters field. When the OpenSSL CMP client processes this response, the NULL dereference occurs, causing a crash of the CMP client. App

• Обновитесь до 3.0.13-0ubuntu3.11
• Обновитесь до 3.0.13-0ubuntu3.12+Fips1
• Обновитесь до 3.0.2-0ubuntu1.25
• Обновитесь до 3.0.2-0ubuntu1.25+Fips1
• Обновитесь до 3.0.21
• Обновитесь до 3.0.22-1~deb12u1
• Обновитесь до 3.4.6
• Обновитесь до 3.5.3-1ubuntu3.4
• Обновитесь до 3.5.6-1~deb13u2
• Обновитесь до 3.5.7
• Обновитесь до 3.6.3
• Обновитесь до 3.6.3-1
• Обновитесь до 4.0.1