Mskowroncf

The issue is related to an unlimited resource allocation vulnerability, causing a rapid increase in memory usage of the system running the quiche server or client. A remote attacker could exploit this by repeatedly sending an unlimited number of 1-RTT CRYPTO frames after completing the QUIC handshake. Exploitation was possible for the duration of the connection, which could be extended by the attacker.

The issue is related to a directory traversal vulnerability that occurs when running a local development server for Pages using the `wrangler pages dev` command. This vulnerability allows an attacker on the same network as the victim to connect to the local development server and access files outside of the development server directory.

The issue arises from insufficient input validation and lack of measures to neutralize instructions in dynamically executed code in the `crypto/rand.Read()` function. This could lead to a predictable shared secret in rare deployment cases where an error is thrown by the `Read()` function. Additionally, the `tkn20` and `blindrsa` components did not check if enough randomness was returned from the user-provided randomness source, typically `crypto/rand.Reader`. If the source does not return the right number of random bytes, the blinding for `blindrsa` is weak, and the integrity of the plaintext is not ensured in `tkn20`.

The issue is caused by a misconfiguration in the manifest file of the WARP client for Android, allowing a task hijacking attack. An attacker can create a malicious mobile application to hijack legitimate apps and steal potentially sensitive information when installed on the victim's device.

Attackers can create long chains of CAs that would lead to OctoRPKI exceeding its max iterations parameter, causing the program to crash and preventing it from finishing the validation, resulting in a denial of service. This issue was discovered and reported by Donika Mirdita and Haya Shulman - Fraunhofer SIT, ATHENE.

The issue allowed a user to delete a VPN profile from the WARP mobile client on the iOS platform, despite the Lock WARP switch feature being enabled on the Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.

The issue allows bypassing policies configured for Zero Trust Secure Web Gateway. This can be achieved by using the `warp-cli` command with the `set-custom-endpoint` subcommand and specifying an unreachable endpoint, which causes the WARP Client to disconnect. As a result, administrative restrictions on a Zero Trust enrolled endpoint can be bypassed.

The issue allowed users to bypass the Lock WARP switch feature on the WARP iOS mobile client. This was possible by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches simultaneously in the application settings, causing the WARP client to disconnect. As a result, users could bypass restrictions and policies enforced by the Zero Trust platform.

The Lock Warp switch feature in the Zero Trust platform can be bypassed due to insufficient policy verification by the WARP iOS client. This bypass can be achieved by using the "Disable WARP" quick action, allowing users of enrolled devices to disable the WARP client even when the Lock Warp switch is enabled.

The issue allows a user without admin privileges to bypass configured Zero Trust security policies, such as Secure Web Gateway policies, and features like 'Lock WARP switch' by utilizing warp-cli subcommands like `disable-ethernet` and `disable-wifi`.

The issue allows creation of mount points from the ProgramData folder of the Cloudflare WARP client during its installation. This could lead to privilege escalation and the overwrite of SYSTEM protected files.

The issue is related to an unquoted service path in Cloudflare Warp for Windows, which enables arbitrary code execution leading to privilege escalation.