Mayank Jangid

Deactivating a user account does not invalidate tokens issued to that account prior to the deactivation. While password authentication correctly rejects disabled accounts, the Core API continues to accept existing, unexpired tokens and allows them to mint replacements. This enables an account to maintain role-scoped access indefinitely after an administrator has disabled it by replaying legitimate credentials. This issue occurs in deployments using Airflow 3 with the FAB auth manager and Core API token authentication when an account is deactivated but its record remains in the database.

Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with `[fab] session backend=database`. This occurs because the cleanup process compares a string identifier stored by Flask-Login in the session against the user's integer database identifier, resulting in a mismatch that prevents session removal. Consequently, an attacker possessing a victim's session cookie maintains access even after a password reset. Additionally, a similar issue exists via the Admin user-edit endpoint.

A crash in the MBIM protocol dissector can lead to a denial of service.

A crash in the Sharkd utility can lead to a denial of service.

A crash in the Frame protocol metadissector allows a denial of service. A metadissector is a component that helps the software determine which dissector should be used to analyze a specific packet.

A large loop in the file parser can be triggered, leading to a denial of service.

قد يحدث استدعاء مؤشر NULL أثناء فك تشفير رسائل «صياغة الرسائل التشفيرية» (CMS) المشفرة بكلمة مرور. تنشأ هذه المشكلة لأن تطبيق OpenSSL لـ CMS يقوم بإلغاء مرجعية الحقل `PasswordRecipientInfo.keyDerivationAlgorithm` دون التحقق من وجوده، على الرغم من أنه محدد كخيار اختياري في مواصفات ASN.1. يمكن للمهاجم استغلال هذه الثغرة عن طريق إرسال رسالة CMS مصممة خصيصًا لهذا الغرض، مما يتسبب في تعطل التطبيق ويؤدي إلى حدوث هجوم رفض الخدمة (DoS).