Jianjun Chen

NLnet Labs Unbound, 1.22.0 up to and including version 1.26.1, contains a DNS-over-QUIC (DoQ) lifetime bug reachable by a remote DoQ client under multi-threaded operation. A client-triggered QUIC path migration can enter stream/connection cleanup while a mesh reply still retains a pointer to the DoQ stream. Cleanup frees the DoQ stream and when the pending mesh reply later completes it dereferences a stale pointer leading to a crash.

In NLnet Labs Unbound up to and including version 1.26.1, an observable cache-level side-channel can be exposed with 'unwanted-reply-threshold > 0' configurations (not a default configuration). If a response-like UDP datagram reaches the upstream source port currently used by a recursive query, but its TXID does not match any pending query, Unbound counts the packet as an unwanted reply. When the accumulated count reaches the configured threshold, Unbound clears the worker's RRset cache and message cache. This cache clear action does not destroy the current upstream UDP pending query. Therefore, an external observer can distinguish whether a candidate port matches the current upstream source port by checking whether an existing cached item has been cleared. This is a cache side-channel vulnerability that can be used to probe the upstream source port. Although the attack is not feasible on default configurations and the suggested value (10 million) makes it an ureliable attack on a public resolver, in scenarios where the attacker can keep a concurrent query window alive, the attacker can first filter the source port and then perform birthday-style guessing against the TXID, making cache poisoning a feasible attack path.

NLnet Labs Unbound up to and including version 1.26.1 limits compression-pointer traversal for each individual domain-name operation but has no aggregate inbound decompression-work budget. Many chained compression pointers in a message results in a lot of CPU usage following them. A malicious actor with recursive-query access and control of an ordinarily delegated authority that serves specially crafted replies can exploit the vulnerability and degrade Unbound's general performance.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات NLnet Labs Unbound من 1.22.0 إلى 1.25.1 **الوصف** يوجد ثغرة في آلية حساب الذاكرة في تطبيق DNS-over-QUIC (DoQ) في اتجاه التدفق. عند تمكين DoQ، يتجاوز أول تيارين ثنائيي الاتجاه في اتصال QUIC جديد (stream id 0 و 4) بوابة `quic-size` الخاصة بكل تيار. يتم تخصيص مخازن مؤقتة كبيرة للمدخلات بعد استلام البادئة ذات الطول 2 بايت من هذه التيارات الأولية، مما يسمح لعميل بعيد بتجاوز حد `quic-size` المُعد بمدخلات ضئيلة. من خلال إرسال بادئة طول مُعلنة تبلغ 65535 بايت وإبقاء التدفقات مفتوحة، يمكن للعميل أن يتسبب في قيام النظام بتخصيص ما يقارب ضعف هذا المبلغ، مما يؤدي إلى رفض الخدمة لعملاء DoQ الجدد. تتطلب هذه المشكلة تجميع البرنامج مع دعم DoQ باستخدام `--with-libngtcp2` وتكوين `quic-port` لواجهات الاستماع. **التوصيات** قم بتحديث NLnet Labs Unbound إلى إصدار أحدث من 1.25.1. كإجراء تخفيفي مؤقت، قم بتعطيل تكوين `quic-port` على واجهات الاستماع أو تجنب استخدام تطبيق DoQ إذا تم تجميعه باستخدام `--with-libngtcp2`.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات NLnet Labs Unbound من 1.22.0 إلى 1.25.1 **الوصف** في بيئات DNS-over-QUIC (DoQ)، قد يؤدي ارتفاع معدل التزامن والضغط على النظام إلى تشغيل تأكيد في مكتبة `libngtcp2` يتعلق بالطوابع الزمنية المتناسقة. يحدث هذا لأن Unbound يستخدم الوقت الفعلي بدلاً من الوقت المتناسق المتوقع عند التفاعل مع `libngtcp2`، مما يؤدي إلى إنهاء عمل الخادم وحجب الخدمة. تتطلب هذه المشكلة تجميع Unbound مع دعم DoQ باستخدام العلامة `--with-libngtcp2` وتكوين `quic-port` لواجهات الاستماع. **التوصيات** بالنسبة للإصدارات من 1.22.0 إلى 1.25.1، قم بتحديث البرنامج إلى إصدار تم فيه حل هذه المشكلة. كإجراء تخفيفي مؤقت، تجنب تكوين `quic-port` لواجهات الاستماع أو قم بتعطيل دعم DNS-over-QUIC.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات NLnet Labs Unbound الأقدم من 1.25.1 **الوصف** توجد مشكلة تتمثل في إمكانية استخدام مجموعات RRSets (مجموعات سجلات الموارد) العشوائية، التي تُكمل ردود نظام أسماء النطاقات (DNS) في قسم السلطة، لخداع النظام ودفعه إلى تخزين سجلات غير مصرح بها في ذاكرة التخزين المؤقت. يمكن للمهاجم تلويث ذاكرة التخزين المؤقت عن طريق إرفاق مثل هذه السجلات برد عبر حزم مزيفة أو هجمات تجزئة. وعلى وجه التحديد، يمكن للمهاجم إدخال مجموعات RRSets بخلاف NS (خادم الأسماء)، مثل MX (تبادل البريد)، مصحوبة بسجلات عناوين في الرد. وقد يقبل النظام بعد ذلك سجلات العناوين ذات الصلة من القسم الإضافي ويخزنها مؤقتًا إذا كانت مجموعة RRSet للسلطة تتمتع بثقة كافية، مثل البيانات داخل المنطقة لنقطة التفويض. **التوصيات** التحديث إلى الإصدار 1.25.1.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** Recursor (الإصدارات المتأثرة غير محددة) **الوصف** قد تؤدي المناطق التي تم إنشاؤها بشكل غير سليم إلى زيادة في استهلاك الموارد. بالإضافة إلى ذلك، قد تؤدي سلاسل CNAME التي تم إنشاؤها بشكل خاص إلى حدوث تسمم ذاكرة التخزين المؤقت في Recursor. **التوصيات** في الوقت الحالي، لا توجد معلومات عن إصدار أحدث يحتوي على تصحيح لهذه الثغرة الأمنية.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات NLnet Labs Unbound حتى الإصدار 1.24.0 بما في ذلك **الوصف** يُعتبر برنامج Unbound عرضة لهجمات اختطاف النطاق من خلال التلاعب باستجابات DNS. وعلى وجه التحديد، يمكن لمجموعات سجلات موارد NS (RRSets) التي تم إنشاؤها بشكل خبيث والمضمنة في الاستجابات أن تجبر برنامج التحليل على تحديث معلومات التفويض الخاصة به، مما قد يؤدي إلى نقل المنطقة. يمكن للمهاجم استغلال هذه الثغرة الأمنية عن طريق حقن مجموعات سجلات موارد NS (RRSets)، ربما من خلال هجمات انتحال الحزم أو تجزئة الحزم، مما يدفع Unbound إلى تحديث بيانات مجموعات سجلات موارد NS الحالية بسبب الثقة المفترضة في المعلومات المحقونة. **التوصيات** قم بالتحديث إلى الإصدار 1.24.1 أو أحدث.

Name of the Vulnerable Software and Affected Versions: Apache CXF versions prior to 3.5.9 Apache CXF versions prior to 3.6.4 Apache CXF versions prior to 4.0.5 Bitbucket Data Center and Server versions 8.9.0 through 8.9.18 Bitbucket Data Center and Server versions 8.18.0 Bitbucket Data Center and Server versions 8.19.0 through 8.19.8 Description: The issue is related to an improper input validation of the `p2c` parameter in the Apache CXF JOSE code, allowing an attacker to perform a denial of service attack by specifying a large value for this parameter in a token. This can lead to uncontrolled resource consumption. An unauthenticated attacker can expose assets in the environment susceptible to exploitation, with no impact to confidentiality, no impact to integrity, and high impact to availability, requiring no user interaction. Recommendations: For Apache CXF versions prior to 3.5.9, update to version 3.5.9 or later. For Apache CXF versions prior to 3.6.4, update to version 3.6.4 or later. For Apache CXF versions prior to 4.0.5, update to version 4.0.5 or later. For Bitbucket Data Center and Server versions 8.9.0 through 8.9.18, upgrade to a release greater than or equal to 8.9.19. For Bitbucket Data Center and Server versions 8.18.0, upgrade to a release greater than or equal to 8.19.9. For Bitbucket Data Center and Server versions 8.19.0 through 8.19.8, upgrade to a release greater than or equal to 8.19.9. As a temporary workaround, consider restricting access to the vulnerable `p2c` parameter in the Apache CXF JOSE code until a patch is available.

**Name of the Vulnerable Software and Affected Versions** net-ip version (affected versions not specified) Traefik version (affected versions not specified) **Description** The issue is related to the incorrect functioning of the `Is` methods (such as `IsPrivate`, `IsLoopback`, etc.) in the net-ip component of the Golang programming language. This incorrect functioning occurs when handling IPv4-mapped IPv6 addresses, where these methods return `false` for addresses that would return `true` in their traditional IPv4 forms. This could allow an attacker to bypass existing access restriction policies. **Recommendations** For net-ip, consider temporarily disabling or restricting the use of the `Is` methods until a patch is available. For Traefik, restrict access to the affected module to minimize the risk of exploitation. Avoid using IPv4-mapped IPv6 addresses in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Squid (affected versions not specified) **Description** The issue is related to the chunked decoder of the Squid proxy server, which is associated with the server's interpretation of fragmented syntax encoding. This can allow a remote attacker to perform Request/Response smuggling past firewall and frontend security systems, potentially enabling direct interaction with the server. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apache Tomcat versions 11.0.0-M1 through 11.0.0-M11 Apache Tomcat versions 10.1.0-M1 through 10.1.13 Apache Tomcat versions 9.0.0-M1 through 9.0.81 Apache Tomcat versions 8.5.0 through 8.5.93 **Description** The issue is related to improper input validation in Apache Tomcat, where the server does not correctly parse HTTP trailer headers. A specially crafted, invalid trailer header could cause Tomcat to treat a single request as multiple requests, leading to the possibility of request smuggling when behind a reverse proxy. **Recommendations** Upgrade to version 11.0.0-M12 onwards Upgrade to version 10.1.14 onwards Upgrade to version 9.0.81 onwards Upgrade to version 8.5.94 onwards

**Name of the Vulnerable Software and Affected Versions** Gevent versions prior to 23.9.1 Gevent version 23.9.0 **Description** The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted script. This can impact the integrity, availability, and confidentiality of protected information. **Recommendations** For Gevent versions prior to 23.9.1, update to version 23.9.1 or later to resolve the issue. For Gevent version 23.9.0, update to version 23.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the WSGIServer component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** protocol-http1 versions prior to 0.15.1 **Description** The issue is related to the implementation of the HTTP/1 protocol in protocol-http1, specifically with the handling of HTTP requests. The problem arises from the acceptance of non-standard formats for the Content-Length header and chunk size, which can lead to desynchronization when forwarding through multiple HTTP parsers. This can potentially result in HTTP request smuggling and firewall bypassing. The behavior does not follow the corresponding RFCs, which define the format for chunk size, chunk data, and chunk extension. There are no known real-world exploits or practical attacks reported. **Recommendations** For protocol-http1 versions prior to 0.15.1, update to version 0.15.1 or later to fix the issue. As a temporary workaround, consider restricting the use of the `Content-Length` header and chunk size to standard formats to minimize the risk of exploitation. Avoid using the `+` prefix and `0x` prefix in the `Content-Length` header and chunk size until the issue is resolved. Restrict access to the vulnerable `protocol-http1` module to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: Squid versions 4.13 and earlier Squid versions 5.x through 5.0.4 Description: The issue is related to the implementation of the uri whitespace configuration in the Squid proxy server, which is associated with insufficient input validation. This can allow a remote attacker to send a hidden HTTP request, also known as an HTTP Request Smuggling attack, potentially accessing services that are otherwise forbidden by security controls. Recommendations: For Squid versions 4.13 and earlier, update to a version that includes the fix for this issue. For Squid versions 5.x through 5.0.4, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting the use of the uri whitespace configuration setting until a patch is available.

**Name of the Vulnerable Software and Affected Versions** macOS versions prior to 10.14 **Description** An input validation issue was addressed with improved input validation. **Recommendations** For versions prior to 10.14, update to macOS Mojave 10.14 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Squid versions prior to 3.5.18 **Description** The issue allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, also known as a "header smuggling" issue. This is related to the `mime header.cc` file in Squid. **Recommendations** For versions prior to 3.5.18, update to version 3.5.18 or later to resolve the issue. As a temporary workaround, consider restricting access to the `mime header.cc` functionality until a patch is available. Avoid using manipulated HTTP Host headers in the affected Squid versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Squid versions prior to 3.5.18 Squid versions 4.x prior to 4.0.10 **Description** The issue allows remote attackers to conduct cache-poisoning attacks via an HTTP request, due to the failure to properly ignore the Host header when an absolute-URI is provided. **Recommendations** For Squid versions prior to 3.5.18, update to version 3.5.18 or later. For Squid versions 4.x prior to 4.0.10, update to version 4.0.10 or later.