Kamil Dudka

Foi identificada uma vulnerabilidade no csmock, na qual um usuário comum do serviço OSH, com um ticket Kerberos válido, pode revelar o token de autenticação confidencial do Snyk e executar comandos arbitrários nos workers do OSH. A vulnerabilidade pode ser explorada por meio de um vetor de ataque na rede local.

The issue arises from an uninitialized random value in libcurl's internal function, which is used to generate nonces for Digest and NTLM authentication, boundary strings in HTTP formposts, and more. This weak or virtually non-existent random value makes the operations that use it vulnerable. The internal function was implemented poorly, overwriting the pointer instead of writing the value into the buffer the pointer pointed to.

The issue allows remote attackers to obtain sensitive information via unspecified vectors. This occurs when cURL and libcurl send the HTTP Basic authentication credentials for a previous connection when reusing a reset connection handle to send a request to the same host name. libcurl can wrongly send HTTP credentials when re-using connections, specifically when using the `curl easy reset()` function, which is supposed to clear the credentials but does not. This can lead to credentials being leaked in subsequent requests to the same hostname.