Summary
[0.4.9.2-1]
- Update yggdrasil to 0.4.9.2
[0.4.9.1-1]
- Update yggdrasil to 0.4.9.1
[0.4.9-5]
- Bump release for rebuild
[0.4.9-4]
- Bump release for rebuild
[0.4.9-3]
- Bump release for rebuild
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | yggdrasil | 0:0.4.9.2-1.el10_2 |
| Oracle Linux · 10 | yggdrasil-devel | 0:0.4.9.2-1.el10_2 |
Vulnerabilities 2
-
High 7.5
Incorrect parsing of IPv6 host literals in net/url
url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.
-
High 7.5
Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.