Jamietanna

**اسم البرنامج المصاب والإصدارات المتأثرة** Renovate الإصدارات السابقة لـ 44.60.1 **الوصف** يوجد تجاوز للقائمة المسموح بها يسمح لمستخدمي المستودعات بتخطي قيود `allowedHeaders`. يحدث هذا عند وضع رؤوس `hostRules` داخل الإعدادات المسبقة المشتركة. يمكن للمهاجم تقديم إعدادات مسبقة داخلية أو خارجية تحتوي على `hostRules[].headers` غير مصدق عليها لحقن رؤوس HTTP مخصصة في الطلبات التي يرسلها Renovate إلى مضيفين آخرين. **التوصيات** التحديث إلى الإصدار 44.60.1 أو أحدث.

**اسم البرنامج المصاب والإصدارات المتأثرة** Renovate الإصدارات السابقة لـ 44.60.1 **Description** يوجد تجاوز للقائمة المسموح بها يسمح للمستودعات بتعيين متغيرات بيئة مقيدة عن طريق وضع `env` داخل إعداد مسبق مشترك. يتيح ذلك للمهاجمين الذين يتحكمون في إعداد مسبق من مصدر خارجي تجاوز متغيرات حاسمة مثل `PATH` أو `LD PRELOAD` أو `NODE OPTIONS` أو `GIT SSL CAINFO` في العمليات التابعة على المثيلات المستضافة ذاتياً. **Recommendations** التحديث إلى الإصدار 44.60.1 أو أحدث.

**Name of the Vulnerable Software and Affected Versions** Renovate versions prior to 44.11.3 **Description** Renovate fails to validate destinations in the Link header when following GitLab server pagination. This allows a compromised GitLab server to specify a Link header pointing to attacker-controlled infrastructure, which can redirect requests containing authentication credentials and lead to their exfiltration. **Recommendations** Update to version 44.11.3 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions prior to 44.11.3 mend-renovate-ce helm chart versions prior to 15.4.0 mend-renovate-enterprise-edition helm chart versions prior to 10.4.0 **Description** When interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, the tool follows pagination links provided in the HTTP `Link` header and sends configured credentials to the URL specified as the next page. Since the pagination URL is not validated against the original host, a compromised or malicious GitHub server can return a `Link` header pointing to an attacker-controlled host, leading to the disclosure of credentials. This requires the GitHub server acting as the repository host or a datasource (such as github-releases, github-tags, or git-refs) to be already compromised. **Recommendations** Update Renovate to version 44.11.3. Update mend-renovate-ce helm chart to version 15.4.0. Update mend-renovate-enterprise-edition helm chart to version 10.4.0.

**Name of the Vulnerable Software and Affected Versions** Renovate versions prior to 44.11.2 Mend Renovate CE/EE images and charts versions prior to 15.4.0 mend-renovate-enterprise-edition helm chart versions prior to 10.4.0 **Description** When listing new package versions from a NuGet registry, the software follows pagination URLs provided in the HTTP `Link` header without verifying if the target shares the same origin as the configured registry. Because registry credentials are included in the request for the next page, a compromised or malicious NuGet registry can redirect these credentials to an attacker-controlled server by providing a malicious `Link` header. This issue allows credentials to be leaked to an additional host chosen by the attacker, provided the remote registry is already malicious or compromised. **Recommendations** Update Renovate to version 44.11.2 or later. Update Mend Renovate CE/EE images and charts to version 15.4.0 or later. Update mend-renovate-enterprise-edition helm chart to version 10.4.0 or later.

**Name of the Vulnerable Software and Affected Versions** Renovate versions prior to 44.14.4 Mend Renovate CE/EE images versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0 **Description** Log sanitization for TLS private keys used for Mutual TLS (a process where both client and server authenticate each other using certificates) was incomplete. While the value of the `hostRules[].httpsPrivateKey` variable was redacted in its own field, the same private key value remained unredacted if it appeared in other configuration options or log messages under different keys. This results in the full private key being written to logs in cleartext, allowing anyone with log access to recover it. This issue specifically affects deployments that configure Mutual TLS via `hostRules[].httpsPrivateKey` instead of using the `secrets` configuration. **Recommendations** Update Renovate to version 44.14.4 or later. Update Mend Renovate CE/EE images to version 15.4.0 or later. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0 or later. As a temporary workaround, supply the private key via the `secrets` configuration.

**Name of the Vulnerable Software and Affected Versions** Renovate versions prior to 44.3.1 Mend Renovate CE/EE images versions prior to 15.4.0 mend-renovate-ce Helm chart versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0 **Description** Digest updates are not subject to internal `minimumReleaseAge` stability age checks. When a repository uses `minimumReleaseAge` and has dependencies with `updateType=digest` (such as Docker images, Go modules, NuGet packages, or GitHub Actions pinned to a commit SHA with a floating tag), the tool may open a pull request for a newly published digest. This allows potentially malicious dependency versions to trigger pull requests and CI workflows before the configured minimum release age has elapsed. **Recommendations** Update Renovate to version 44.3.1. Update Mend Renovate CE/EE images to version 15.4.0. Update mend-renovate-ce Helm chart to version 15.4.0. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0. As a temporary workaround, disable digest updates or gate them behind `dependencyDashboardApproval`.

**Name of the Vulnerable Software and Affected Versions** Renovate versions prior to 44.11.2 Mend Renovate CE/EE versions prior to 15.4.0 mend-renovate-enterprise-edition Helm chart versions prior to 10.4.0 **Description** When listing tags or digests for a container image, the tool follows pagination links provided by the remote registry in the HTTP Link header. It attaches registry credentials to the subsequent request without verifying if the pagination URL shares the same origin as the original registry. A compromised or malicious registry could provide a Link header pointing to an attacker-controlled host, allowing the attacker to capture the credentials used for that registry. This issue affects targets with container dependencies that interact with a malicious registry. **Recommendations** Update Renovate to version 44.11.2. Update Mend Renovate CE/EE to version 15.4.0. Update mend-renovate-enterprise-edition Helm chart to version 10.4.0.