Sandipan Roy

Uma falha existe no `AwsAlbKeyResolver` do SmallRye JWT, utilizado para verificar JSON Web Tokens assinados por AWS Application Load Balancers. Quando o provedor de chaves `AWS ALB` está ativo, o resolver constrói a URL de busca de chave concatenando o valor do cabeçalho `kid` de um JWT recebido sem sanitizar caracteres de travessia de caminho (path traversal) ou separadores de string de consulta. Isso permite que um invasor remoto não autenticado force o servidor da aplicação a emitir requisições GET para caminhos arbitrários na mesma origem do endpoint de chave configurado, podendo expor endpoints não públicos ou dados internos antes que a assinatura do JWT seja verificada. Trata-se de um Server-Side Request Forgery (SSRF), onde o servidor é enganado para fazer requisições aos seus próprios recursos internos.

A validação insuficiente de URLs de serviço JMX controladas pelo cliente na funcionalidade de proxy JSR-160 permite a evasão da lista de bloqueio existente. O proxy aceita um valor `target.url` de uma requisição POST do Jolokia e o encaminha para `JMXServiceURL` e `JMXConnectorFactory` para estabelecer a conexão JMX remota. Como a lista de bloqueio apenas rejeita URLs que correspondam a `service:jmx:rmi:///jndi/ldap:.*`, atacantes podem utilizar formas alternativas, incluindo esquemas `ldaps://` ou URLs LDAP com um componente de host JMX não vazio. Isso pode forçar a JVM do agente Jolokia a realizar uma consulta JNDI (Java Naming and Directory Interface) em um endpoint LDAP controlado por um atacante, resultando potencialmente em server-side request forgery (SSRF), encaminhamento de credenciais JMX para o endpoint remoto e, possivelmente, execução remota de código.

Uma falha no utilitário sos clean, dentro do pacote sos, permite que um invasor local crie ou sobrescreva arquivos arbitrários. O problema decorre de uma falha de path traversal durante a extração de arquivos tar, onde os alvos de symlink e hardlink não são validados adequadamente. Isso permite que um invasor grave arquivos em qualquer local do sistema usando os privilégios do processo sos clean, que normalmente é executado como root.

Um problema existe no processamento de arquivos tarball do rpmbuild. Ao operar no modo tarball (como -ts, -ta ou -tb), a função `getTarSpec()` em tools/rpmbuild.cc passa o nome de um membro de um arquivo de origem manipulado para a função `rpmExpand()` como parte de uma expressão de macro %{basename:...}. Isso permite que um invasor injete macros do RPM, incluindo expressões Lua, resultando na execução de código arbitrário com os privilégios do usuário que executa o processo.

Uma operação de buffer fora dos limites existe nos subsistemas xfrm-ESP e RxRPC. O processamento criptográfico inseguro no local de fragmentos de buffer de socket compartilhados permite que um invasor local com baixos privilégios corrompa o conteúdo do cache de página de arquivos legíveis, incluindo arquivos sensíveis do sistema, e obtenha privilégios de root. A variante xfrm-ESP requer a criação de um namespace de rede ou um usuário sem privilégios, enquanto a variante RxRPC depende da disponibilidade do módulo `rxrpc` no sistema alvo. O problema ocorre porque os caminhos de anexo de datagramas IPv4/IPv6 não definiram a flag `SKBFL SHARED FRAG` ao realizar o splice de páginas em skbs UDP, fazendo com que a entrada ESP descriptografasse dados no local sobre fragmentos que não pertenciam privadamente ao skb.

A flaw in the oFono interface for working with mobile connectivity is related to a buffer overflow in the `decode deliver()` function during SMS decoding. This issue can be exploited by a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or via SMS. A bound check for the `memcpy` length in `decode submit()` was forgotten in `decode deliver()`, leading to the stack overflow bug.

A vulnerability was found related to the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange, which differ from response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue is associated with information disclosure through inconsistency. Exploitation of the vulnerability may allow a remote attacker to access confidential data.

A flaw was found in 3Scale Admin Portal. If a user logs out from the personal tokens page and then presses the back button in the browser, the tokens page is rendered from the browser cache, potentially allowing an attacker to disclose protected information.

A security issue occurs as the Hot Rod client and Netty do not enable hostname validation when using TLS, possibly resulting in a man-in-the-middle (MITM) attack. This issue can allow a remote attacker to execute a man-in-the-middle attack.

A vulnerability was found in the implementation of the TLS protocol in the Quarkus Java framework. This issue is related to the insufficient reliability of encryption when using the quarkus.http.ssl.protocols configuration. The vulnerability occurs because the TLS protocol configured with quarkus.http.ssl.protocols is not enforced, allowing a client to force the selection of a weaker supported TLS protocol. This could potentially allow a remote attacker to gain unauthorized access to protected information.

A security flaw in OpenSC causes a buffer overrun vulnerability in `pkcs15` `cardos have verifyrc package`. An attacker can supply a smart card package with malformed ASN1 context. The `cardos have verifyrc package` function scans the ASN1 buffer for 2 tags, where the remaining length is wrongly calculated due to a moved starting pointer. This leads to a possible heap-based buffer out of bounds read. In cases where ASAN is enabled while compiling, this causes a crash. Further information leak or more damage is possible.

The issue is related to a null pointer dereference in the `ber memalloc x()` function. This can be exploited by a remote attacker to cause a denial of service. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. The technical details about exploitation include a null pointer dereference in the `ber memalloc x()` function.

A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the `decode status report()` function during SMS decoding. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for the `memcpy` length in `decode submit()`, but it was forgotten in `decode status report()`. This vulnerability may allow a remote attacker to access confidential data, disrupt its integrity, and cause a denial of service.

A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the `decode deliver report()` function during SMS decoding. This issue is related to the parsing of SMS PDUs and can be exploited remotely without requiring authentication. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or via SMS. A bound check for the `memcpy` length was forgotten in `decode deliver report()`, unlike in `decode submit()`.

A flaw in oFono, an Open Source Telephony on Linux, is related to a stack overflow bug triggered within the `decode submit report()` function during SMS decoding in PDU format. This issue may allow a remote attacker to execute arbitrary code. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or just SMS. There is a bound check for the `memcpy` length in `decode submit()`, but it was forgotten in `decode submit report()`.

A flaw was found in ofono, an Open Source Telephony on Linux, where a stack overflow bug is triggered within the `sms decode address field()` function during the SMS PDU decoding. This issue can be exploited remotely, potentially allowing an attacker to execute arbitrary code. The attack scenario is assumed to be accessible from a compromised modem, a malicious base station, or just SMS.

A security flaw in the libtiff library causes a heap buffer overflow in the `extractContigSamples32bits()` function, located in tiffcrop.c. This issue can be exploited by an attacker using specially crafted data, potentially leading to a denial of service.

The undertow client does not check the server identity presented by the server certificate in https connections, which is a compulsory step that should be performed by default in https and http/2. This issue affects the TLS client protocol.

The issue is related to the Quarkus Form Authentication session cookie Path attribute being set to `/`, which may lead to a cross-site attack and potentially result in Information Disclosure. This can be prevented by using the Quarkus CSRF Prevention feature. The vulnerability is also associated with a lack of protection for the web page structure, which could allow a remote attacker to conduct a cross-site scripting (XSS) attack.

Foi encontrada uma falha no codeplex-codehaus, permitindo que um ataque de traversal de diretório acesse arquivos e diretórios armazenados fora da pasta pretendida. Ao manipular arquivos com sequências `../` e suas variações ou ao usar caminhos absolutos de arquivos, pode ser possível acessar arquivos e diretórios arbitrários armazenados no sistema de arquivos, incluindo código-fonte de aplicativos, configuração e outros arquivos críticos do sistema.