Поиск уязвимостей

ELSA-2026-5942: golang security update (IMPORTANT)

ELSA-2026-5941: golang security update (IMPORTANT)

ELSA-2026-36317: skopeo security update (IMPORTANT)

ELSA-2026-19181: golang security update (IMPORTANT)

ELSA-2026-19126: yggdrasil security update (IMPORTANT)

ELSA-2026-19049: golang-github-openprinting-ipp-usb security update (IMPORTANT)

ELSA-2026-19022: golang security update (IMPORTANT)

ELSA-2026-19017: podman security update (IMPORTANT)

Important: runc security update

ELSA-2026-29702: runc security update (IMPORTANT)

Уязвимость golang

Уязвимость golang

On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.

Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.

Уязвимость модуля html/template языка программирования Go, позволяющая нарушителю проводить межсайтовые сценарные атаки (XSS)

Уязвимость функций File.ReadDir() и File.Readdir() языка программирования Go, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации

Important: containernetworking-plugins security update

Important: buildah security update

Important: skopeo security update

Important: git-lfs security update