Adamkorcz

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** An issue exists in the Remember-Me token validation logic where the system fails to invalidate all active sessions when a compromised token is detected. Gitea uses a split token design consisting of an ID and a Hash. When a token is used, the Hash is rotated while the ID remains constant. If an attacker steals a token and authenticates, they receive a new rotated token. When the legitimate user subsequently attempts to use their original token, the system detects a hash mismatch. While the `CheckAuthToken()` function identifies this mismatch, the `autoSignIn` process only deletes the local cookie of the victim and does not remove the compromised token from the database. This allows an attacker to maintain persistent access to the account. The affected endpoint is `POST /user/login` and any other endpoint that triggers `autoSignIn` via the Remember-Me cookie. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** An authenticated user can cause a denial of service by submitting a specially crafted RFC 4716 (SSH2) public key to the SSH key ingestion endpoint. The issue stems from a normalization function that uses an O(N²) string concatenation loop without input size limits. When a key contains a large number of short content lines, the server performs a quadratic amount of work in both time and memory allocations because Go strings are immutable, requiring a new array allocation and copy for every concatenation. This can lead to CPU and memory exhaustion, taking the instance offline. **API Endpoints:** '/api/v1/user/keys' **Vulnerable Parameters or Variables:** `key` **Function Names:** `parseKeyString()`, `CheckPublicKeyString()`, `CreateUserPublicKey()` **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** A privilege escalation issue exists in the API endpoint `POST /users/{username}/tokens` used for creating Personal Access Tokens. The endpoint is protected by the `reqBasicOrRevProxyAuth` middleware, which is designed to require password-based authentication to prevent a compromised token from being used to generate new ones. However, if a token is provided in the `Authorization: Basic <token>:x-oauth-basic` format, the system incorrectly sets the `AuthedMethod` to `basic` and `IsBasicAuth` to `true`, bypassing the middleware guard. Once the guard is bypassed, the `CreateAccessToken` function fails to enforce a scope ceiling, meaning it does not verify if the requested scopes are a subset of the caller's current scopes. Consequently, an attacker possessing a restricted token (such as one with only `write:user` permissions) can create a new token with the `all` scope, granting full administrative access to the account without knowing the user's password. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** The Debian package registry parser contains two issues that can lead to a complete denial of service. First, an unbounded decompression flaw exists in the `ParseControlFile()` function. When processing an uploaded `.deb` file, the parser decompresses `control.tar.gz` and copies the stream into a `strings.Builder` without limiting the amount of data read. An attacker can use a decompression bomb—a small payload that expands to a massive size—to exhaust server memory. Second, the parser uses `+=` for string concatenation when processing continuation lines in the Description field, resulting in `O(N²)` allocation and copy operations. This can saturate the CPU and trigger frequent garbage collection cycles. Any authenticated user with write access to the package registry can trigger these issues via a request to the handler at `routers/api/packages/debian/debian.go:146`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** The product name cannot be determined (affected versions not specified) **Description** An unauthenticated Regular Expression Denial of Service (ReDoS) exists due to improper pattern matching within the CODEOWNERS file processing. This allows a remote attacker to cause a denial of service by providing a specially crafted pattern that triggers excessive CPU consumption during the matching process. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Allstar versions prior to 4.5 **Description** Allstar is a GitHub App used for setting and enforcing security policies. A flaw exists in the Reviewbot component where inbound webhook requests were validated against a hard-coded, shared secret. This secret token was compiled into the Allstar binary and could not be configured during runtime. Deployments using Reviewbot validated requests with the same secret unless the operator modified the source code and rebuilt the component. This expectation was not documented and easily overlooked. Deployments that have not enabled or exposed the Reviewbot endpoint are not affected. **Recommendations** Update to version 4.5 or later. If the Reviewbot endpoint is not in use, no action is required.

**Name of the Vulnerable Software and Affected Versions** PowSyBl versions prior to 6.7.2 **Description** The issue concerns an XML external entity (XXE) attack and a server-side request forgery (SSRF) attack in certain places of powsybl-core XML parsing. This allows an attacker to elevate their privileges to read files that they do not have permissions to, including sensitive files on the system. The vulnerable class is `com.powsybl.commons.xml.XmlReader`, which is considered untrusted in use cases where untrusted users can submit their XML to the vulnerable methods. This can be a multi-tenant application that hosts many different users, perhaps with different privilege levels. **Recommendations** For versions prior to 6.7.2, update to com.powsybl:powsybl-commons: 6.7.2 or higher to patch the issue. As a temporary workaround, consider restricting access to the `com.powsybl.commons.xml.XmlReader` class to minimize the risk of exploitation. Avoid allowing untrusted users to import untrusted CGMES or XIIDM network files until the issue is resolved.

Name of the Vulnerable Software and Affected Versions: com.powsybl:powsybl-iidm-criteria versions 6.3.0 through 6.7.1 com.powsybl:powsybl-contingency-api versions 5.0.0 through 5.0.0 Description: The issue is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the RegexCriterion class. This class compiles and evaluates an unvalidated, user-supplied regular expression against the identifier of an Identifiable object via Pattern.compile(regex).matcher(id).find(). If successfully exploited, a malicious actor can cause significant CPU exhaustion through repeated or recursive filter(...) calls — especially if performed over large network models or filtering operations. Recommendations: For com.powsybl:powsybl-iidm-criteria versions 6.3.0 through 6.7.1, update to version 6.7.2 or higher. For com.powsybl:powsybl-contingency-api versions 5.0.0, update to a version higher than 5.0.0, however, the exact fixed version for this component is not specified. As a temporary workaround, consider restricting the use of the RegexCriterion class until a patch is available. Avoid using untrusted regular expressions and potentially attacker-controlled identifiers in the RegexCriterion class to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** PowSyBl versions prior to 6.7.2 **Description** The issue is a potential polynomial Regular Expression Denial of Service (ReDoS) vulnerability in the PowSyBl's DataSource mechanism. This vulnerability can be exploited when the `listNames(String regex)` method is called on a DataSource with a user-supplied regular expression, allowing a malicious actor to cause significant CPU consumption due to regex backtracking. The attack requires control over the regex input and influence over the file/resource names being matched. In a multi-tenant environment, this can degrade the performance and availability of the server, affecting other users of the application. **Recommendations** For versions prior to 6.7.2, update to com.powsybl:powsybl-commons:6.7.2 or higher to patch the vulnerability. As a temporary workaround, consider restricting access to the `listNames(String regex)` method or validating user-supplied regular expressions to minimize the risk of exploitation. Avoid using unvalidated user-supplied regular expressions in the `listNames(String regex)` method until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** PowSyBl versions 6.3.0 through 6.7.1 **Description** The issue is a deserialization problem in the `read` method of the `SparseMatrix` class, which can lead to various privilege escalations depending on the circumstances. This method takes an `InputStream` and returns a `SparseMatrix` object. Users are vulnerable if they import non-controlled serialized `SparseMatrix` objects. This can be particularly problematic in multi-tenant applications where users with different privilege levels can submit an `InputStream` to be parsed into a `SparseMatrix`, or when using the method for a local tool with `InputStream` from external sources. **Recommendations** For versions 6.3.0 through 6.7.1, consider updating to com.powsybl:powsybl-math:6.7.2 or higher to resolve the issue. As a temporary workaround, do not use `SparseMatrix` deserialization (`SparseMatrix.read(...)` methods) until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** tough versions prior to 0.20.0 **Description** The issue arises during a snapshot rollback when the client incorrectly caches the timestamp metadata. This leads to a failure in update timestamp validation, preventing further updates until the cache is cleared. The problem occurs because the client will persist invalid timestamp metadata to its cache, which may then cause it to incorrectly identify valid timestamp metadata as being rolled back. This prevents the client from consuming valid updates. **Recommendations** For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

**Name of the Vulnerable Software and Affected Versions** tough versions prior to 0.20.0 **Description** The issue arises from missing validation of terminating delegation, causing the client to continue searching the defined delegation list even after encountering a terminating delegation. This could lead to the client fetching a target from an incorrect source, altering the target contents. Delegations are a mechanism that allows multiple identities to provide and sign content within a single repository, with terminating delegations and delegation priority giving unambiguous control over how overlapping delegations are resolved. However, the tough client erroneously does not terminate the search as required and accepts information from a lower-priority delegation that should have been ignored. When interacting with repositories that use delegations, the tough client could fetch targets owned by the incorrect role, allowing an actor with delegated ownership to provide arbitrary contents. **Recommendations** For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

**Name of the Vulnerable Software and Affected Versions** tough versions prior to 0.20.0 **Description** The issue arises from missing validation of the root metadata version number, allowing an actor to supply an arbitrary version number to the client. This could lead to the client trusting an outdated or rotated root role, potentially trusting content associated with a previous root role. Users should upgrade to a version that incorporates the new fixes to prevent this issue. **Recommendations** For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

**Name of the Vulnerable Software and Affected Versions** tough versions prior to 0.20.0 **Description** The issue arises during a target rollback when the client fails to detect the rollback for delegated targets, potentially causing it to fetch a target from an incorrect source and alter the target contents. This could lead to the client trusting and downloading outdated targets that it should reject. **Recommendations** For versions prior to 0.20.0, upgrade to tough version 0.20.0 or later and ensure any forked or derivative code is patched to incorporate the new fixes.

**Name of the Vulnerable Software and Affected Versions** go-tuf versions prior to 2.0.1 **Description** The go-tuf client inconsistently traces the delegations, which can result in downloading the wrong artifact. For example, if targets delegate to "A" and "B", and "B" delegates to "C", the client should trace the delegations in the order "A" then "B" then "C", but it may incorrectly trace the delegations "B"->"C"->"A". This issue is related to the `GetRolesForTarget` function, which returns a map that causes this behavior. **Recommendations** For go-tuf versions prior to 2.0.1, update to version 2.0.1 to fix the inconsistent delegation tracing issue. As a temporary workaround, consider reviewing and verifying the delegation paths manually to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** basic-auth-connect versions prior to 1.1.0 **Description** The issue concerns a timing-unsafe equality comparison in basic-auth-connect that can leak timing information. This comparison can potentially allow an attacker to observe differences in response times, which may lead to security issues. The problem has been fixed in version 1.1.0 of basic-auth-connect. **Recommendations** For versions prior to 1.1.0, update to basic-auth-connect 1.1.0 to fix the timing information leak in Basic Auth middleware. As a temporary workaround, consider restricting access to the Basic Auth functionality until the update can be applied.

**Name of the Vulnerable Software and Affected Versions** serve-static versions prior to 1.16.0 **Description** The issue allows execution of untrusted code by passing untrusted user input to the `redirect()` function, even after sanitizing it. This can be exploited if an attacker controls the input to `response.redirect()`, express does not redirect before the template appears, and the browser does not complete redirection before the user clicks on the link in the template. **Recommendations** For versions prior to 1.16.0, upgrade to serve-static 1.16.0 to patch the issue. As a temporary workaround, ensure any untrusted inputs are safe by validating them against an explicit allowlist.

**Name of the Vulnerable Software and Affected Versions** Express.js versions prior to 4.20.0 **Description** The issue concerns the execution of untrusted code when passing untrusted user input to the `response.redirect()` function in Express.js, even after sanitizing the input. This can occur when an attacker controls the input to `response.redirect()`, Express.js does not redirect before the template appears, and the browser does not complete redirection before the user clicks on the link in the template. **Recommendations** For Express.js versions prior to 4.20.0, upgrade to version 4.20.0 to patch the issue. As a temporary workaround, ensure any untrusted inputs are safe by validating them against an explicit allowlist before passing them to the `response.redirect()` function.

**Name of the Vulnerable Software and Affected Versions** Send versions prior to 0.19.0 **Description** The issue arises from passing untrusted user input to `SendStream.redirect()`, which can execute untrusted code. This occurs even when the input is sanitized. The library Send is used for streaming files from the file system as an HTTP response. **Recommendations** For versions prior to 0.19.0, update to version 0.19.0 to patch the issue. As a temporary workaround, ensure any untrusted inputs are safe by validating them against an explicit allowlist.

Name of the Vulnerable Software and Affected Versions: sigstore-go versions prior to 0.6.1 Description: The issue is related to a denial of service attack that can occur when a verifier is provided a maliciously crafted Sigstore Bundle containing large amounts of verifiable data. This data can be in the form of signed transparency log entries, RFC 3161 timestamps, and attestation subjects. The verification of these data structures is computationally expensive and can be used to consume excessive CPU resources, leading to a denial of service attack. This type of vulnerability is labeled as an "Endless data attack" by TUF's security model and can lead to verification failing to complete and disrupting services that rely on sigstore-go for verification. Recommendations: For versions prior to 0.6.1, upgrade to sigstore-go 0.6.1 or later to address the vulnerability. As a temporary workaround for users who are vulnerable but unable to quickly upgrade, consider adding manual bundle validation to enforce limits similar to those in the referenced patch prior to calling sigstore-go's verification functions.