Chenjj

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Caddy من 2.7.0 إلى 2.11.2 **الوصف** تستخدم دالة `splitPos()` الخاصة بنقل FastCGI في `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go` ميزة `search.IgnoreCase` الخاصة بمكتبة `golang.org/x/text/search` بشكل خاطئ عندما يحتوي مسار الطلب على بايتات غير ASCII. ويؤدي ذلك إلى عيبين: مشكلة في تدفق التحكم حيث تسمح متغير `match` قديم بمعاملة الملفات غير النصية كملفات نصية، ومشكلة في تكافؤ Unicode حيث يتم تحويل الأحرف المشابهة لغير أحرف ASCII إلى أحرف ASCII (على سبيل المثال، معاملة `.𝗽𝗵𝗽` على أنها `.php`). في عمليات النشر التي يمكن للمهاجم فيها تحميل أو وضع محتوى في ملفات يتم تقديمها عبر FastCGI، يمكن استغلال هذه الثغرات عن طريق إنشاء عنوان URL محدد لتحقيق تنفيذ التعليمات البرمجية عن بُعد. **التوصيات** التحديث إلى الإصدار 2.11.3.

**Name of the Vulnerable Software and Affected Versions** go-jose versions prior to 2.6.3 go-jose versions prior to 3.0.3 go-jose versions prior to 4.0.1 **Description** The issue is related to the incorrect handling of highly compressed input data in the go-jose package, which implements the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by `Decrypt` or `DecryptMulti` functions. These functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). **Recommendations** For versions prior to 2.6.3, update to version 2.6.3 or later. For versions prior to 3.0.3, update to version 3.0.3 or later. For versions prior to 4.0.1, update to version 4.0.1 or later. As a temporary workaround, consider restricting the use of the `Decrypt` and `DecryptMulti` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Gevent versions prior to 23.9.1 Gevent version 23.9.0 **Description** The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted script. This can impact the integrity, availability, and confidentiality of protected information. **Recommendations** For Gevent versions prior to 23.9.1, update to version 23.9.1 or later to resolve the issue. For Gevent version 23.9.0, update to version 23.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the WSGIServer component until a patch is available.

Name of the Vulnerable Software and Affected Versions: Yii versions 2.x through 2.0.15.1 Description: The issue arises from the active conversion of a wildcard CORS policy into reflecting an arbitrary Origin header value. This behavior is incompatible with the CORS security design and could lead to CORS misconfiguration security problems. Recommendations: For versions 2.x through 2.0.15.1, consider disabling the automatic conversion of wildcard CORS policies to prevent reflecting arbitrary Origin header values until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.