ALT-PU-2025-13422: package keycloak update to version 26.4.0-alt1
Описание
This update upgrades keycloak to version 26.4.0-alt1.
Устраненные уязвимости38
Ссылки26
GHSA-269m-c36j-r834
https://github.com/advisories/GHSA-269m-c36j-r834GHSA-3p8m-j85q-pgmj
https://github.com/advisories/GHSA-3p8m-j85q-pgmjGHSA-5545-r4hg-rj4m
https://github.com/advisories/GHSA-5545-r4hg-rj4mGHSA-5jfq-x6xp-7rw2
https://github.com/advisories/GHSA-5jfq-x6xp-7rw2GHSA-5rxp-2rhr-qwqv
https://github.com/advisories/GHSA-5rxp-2rhr-qwqvGHSA-9342-92gg-6v29
https://github.com/advisories/GHSA-9342-92gg-6v29GHSA-93ww-43rr-79v3
https://github.com/advisories/GHSA-93ww-43rr-79v3GHSA-9623-mj7j-p9v4
https://github.com/advisories/GHSA-9623-mj7j-p9v4GHSA-c69w-jj56-834w
https://github.com/advisories/GHSA-c69w-jj56-834wGHSA-cxrx-q234-m22m
https://github.com/advisories/GHSA-cxrx-q234-m22mGHSA-f4v7-3mww-9gc2
https://github.com/advisories/GHSA-f4v7-3mww-9gc2GHSA-fghv-69vj-qj49
https://github.com/advisories/GHSA-fghv-69vj-qj49GHSA-g4gc-rh26-m3p5
https://github.com/advisories/GHSA-g4gc-rh26-m3p5GHSA-hfq9-hggm-c56q
https://github.com/advisories/GHSA-hfq9-hggm-c56qGHSA-hw58-3793-42gg
https://github.com/advisories/GHSA-hw58-3793-42ggGHSA-j288-q9x7-2f5v
https://github.com/advisories/GHSA-j288-q9x7-2f5vGHSA-jgwc-jh89-rpgq
https://github.com/advisories/GHSA-jgwc-jh89-rpgqGHSA-v4jw-m6rm-399h
https://github.com/advisories/GHSA-v4jw-m6rm-399hGHSA-v7gv-xpgf-6395
https://github.com/advisories/GHSA-v7gv-xpgf-6395GHSA-w3g8-r9gw-qrh8
https://github.com/advisories/GHSA-w3g8-r9gw-qrh8GHSA-w8gr-xwp4-r9f7
https://github.com/advisories/GHSA-w8gr-xwp4-r9f7GHSA-wq8x-cg39-8mrr
https://github.com/advisories/GHSA-wq8x-cg39-8mrrGHSA-xgfv-xpx8-qhcr
https://github.com/advisories/GHSA-xgfv-xpx8-qhcrGHSA-xhpr-465j-7p9q
https://github.com/advisories/GHSA-xhpr-465j-7p9qСвязанные уязвимости
ALT-PU-2025-2871: package `keycloak` update to version 26.1.2-alt1
Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
Apache Sling Commons Messaging Mail provides a simple layer on top of JavaMail/Jakarta Mail for OSGi to send mails via SMTPS. To reduce the risk of "man in the middle" attacks additional server identity checks must be performed when accessing mail servers. For compatibility reasons these additional checks are disabled by default in JavaMail/Jakarta Mail. The SimpleMailService in Apache Sling Commons Messaging Mail 1.0 lacks an option to enable these checks for the shared mail session. A user could enable these checks nevertheless by accessing the session via the message created by SimpleMessageBuilder and setting the property mail.smtps.ssl.checkserveridentity to true. Apache Sling Commons Messaging Mail 2.0 adds support for enabling server identity checks and these checks are enabled by default. - https://javaee.github.io/javamail/docs/SSLNOTES.txt - https://javaee.github.io/javamail/docs/api/com/sun/mail/smtp/package-summary.html - https://github.com/eclipse-ee4j/mail/issues/429
Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Apache Sling Commons Messaging Mail
Уязвимость функции SearchQueryUtils программного средства для управления идентификацией и доступом Keycloak, позволяющая нарушителю вызвать отказ в обслуживании