Описание
Security update for python-pydata-sphinx-theme
This update for python-pydata-sphinx-theme fixes the following issues:
Changes in python-pydata-sphinx-theme:
-
Refresh js dependencies:
- ws to 7.5.11 (bsc#1268957, CVE-2026-48779)
-
Refresh vendored tarball (CVE-2026-6321, bsc#1264374)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1264374
- SUSE Bug 1268957
- SUSE CVE CVE-2026-48779 page
- SUSE CVE CVE-2026-6321 page
Описание
ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.
Затронутые продукты
Ссылки
- CVE-2026-48779
- SUSE Bug 1268904
Описание
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
Затронутые продукты
Ссылки
- CVE-2026-6321
- SUSE Bug 1264367