Ian Carroll

Name of the Vulnerable Software and Affected Versions: FlyCASS CASS and KCM systems (affected versions not specified) Description: The issue is related to a flaw in SQL query filtering in FlyCASS CASS and KCM systems, making them vulnerable to attack by outside attackers with no authentication. This allows unauthenticated attackers to potentially inject SQL queries. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue allows an attacker to unlock arbitrary doors at a property via forged keycards, if the attacker has obtained one active or expired keycard for the specific property. This occurs because the key derivation function relies only on a `UID`.

The issue is related to the recognition of "e-Tugra" root certificates by Certifi, a collection of Root Certificates for validating SSL certificates. e-Tugra's root certificates were subject to an investigation due to reported security issues. The problem is associated with insufficient authentication data verification, which could allow a remote attacker to implement a "man-in-the-middle" attack.

Name of the Vulnerable Software and Affected Versions: Redash versions 10.0 and prior Description: Redash is a package for data visualization and sharing. The implementation of URL-loading data sources like JSON, CSV, or Excel in versions 10.0 and prior is vulnerable to advanced methods of Server Side Request Forgery (SSRF). These vulnerabilities are only exploitable on installations where a URL-loading data source is enabled. The `master` and `release/10.x.x` branches address this by applying the Advocate library for making http requests instead of the requests library directly. Recommendations: To resolve the issue, users should upgrade to version 10.0.1 to receive the patch. As a temporary workaround, one can disable the vulnerable data sources entirely by adding an environment variable to the configuration. One can also switch any data source of certain types to be `View Only` for all groups on the Settings > Groups > Data Sources screen. For users unable to update, an admin may modify Redash's configuration through environment variables to mitigate this issue. Depending on the version of Redash, an admin may also need to run a CLI command to re-encrypt some fields in the database. For existing installations, one will need to ensure that explicit values are set for the `REDASH COOKIE SECRET` and `REDASH SECRET KEY` variables.

Redash is a package for data visualization and sharing. If an admin sets up Redash without explicitly specifying the `REDASH COOKIE SECRET` or `REDASH SECRET KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH COOKIE SECRET` or `REDASH SECRET KEY` environment variables have not been explicitly set. Users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository are not affected, as these instances automatically generate unique secret keys during installation. One can verify whether their instance is affected by checking the value of the `REDASH COOKIE SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, they should follow the steps to secure the instance.

The issue is related to Improper Access Control on the Configurations Endpoint for the Stable API of Apache Airflow. This allows users with Viewer or User role to obtain Airflow Configurations, including sensitive information, even when the `[webserver] expose config` is set to `False` in `airflow.cfg`. This vulnerability enabled a privilege escalation attack.

The issue concerns the lineage endpoint of the deprecated Experimental API in Apache Airflow, which was not protected by authentication. This allowed unauthenticated users to access the endpoint. The attacker needs to be aware of certain parameters to pass to the endpoint, and even then, they can only obtain some metadata about a DAG and a Task. This is considered a low-severity issue.