Agustingianni

**Name of the Vulnerable Software and Affected Versions** HyperKit version 0.20210107 **Description** HyperKit is a toolkit for embedding hypervisor capabilities in an application. The function `pci vtsock proc tx` in `virtio-sock` can lead to uninitialized memory use due to an insufficient check for the return value. If the function returns `-1` upon encountering an unrecoverable error, the negative return value can be used by `iovec pull` in a while condition, potentially leading to further corruption because `iovec pull` is not designed to handle a negative `iov len`. This issue may cause a guest to crash the host, resulting in a denial of service, and under certain circumstances, memory corruption. **Recommendations** For HyperKit version 0.20210107, update to a version that includes the fix from commit af5eba2360a7351c08dfd9767d9be863a50ebaba to resolve the issue. As a temporary workaround, consider restricting the use of the `virtio-sock` module to minimize the risk of exploitation. Avoid using the `pci vtsock proc tx` function until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Nokogiri versions prior to 1.13.6 **Description** The issue is related to the incorrect handling of unexpected data types in the Nokogiri library for Ruby. This can allow a remote attacker to disclose protected information or cause a denial of service. The library does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors or reads from unrelated memory. **Recommendations** For versions prior to 1.13.6, upgrade to Nokogiri version 1.13.6 or later. As a temporary workaround, ensure the untrusted input is a `String` by calling `#to s` or equivalent.

**Name of the Vulnerable Software and Affected Versions** hbs (affected versions not specified) **Description** The hbs package, an Express view engine wrapper for Handlebars, may be vulnerable to a file disclosure issue depending on its usage. This occurs because hbs combines pure template data with engine configuration options through the Express render API, allowing the overwrite of internal configuration options. This can trigger a file disclosure vulnerability in downstream applications. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** express-hbs (affected versions not specified) **Description** The issue arises from express-hbs mixing pure template data with engine configuration options through the Express render API, potentially leading to file disclosure vulnerabilities in downstream applications. This is somewhat restricted, as only files with existing extensions can be included. Files lacking an extension will have .hbs appended to them. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** haml-coffee versions prior to 1.14.1 **Description** haml-coffee is a JavaScript templating solution that mixes pure template data with engine configuration options through the Express render API. It supports overriding a series of HTML helper functions through its configuration options. A vulnerable application that passes user-controlled request objects to the haml-coffee template engine may introduce Remote Code Execution (RCE) vulnerabilities. Additionally, control over the `escapeHtml` parameter through template configuration pollution ensures that haml-coffee would not sanitize template inputs, which may result in reflected Cross Site Scripting attacks against downstream applications. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Squirrelly versions prior to 9.0.0 **Description** Squirrelly is a template engine implemented in JavaScript that works out of the box with ExpressJS. It mixes pure template data with engine configuration options through the Express render API. By overwriting internal configuration options, remote code execution may be triggered in downstream applications. **Recommendations** For versions prior to 9.0.0, update to version 9.0.0 to resolve the issue. As a temporary workaround, consider restricting access to the Express render API to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Express-handlebars (affected versions not specified) **Description** The layout parameter in Express-handlebars may trigger file disclosure vulnerabilities in downstream applications, allowing inclusion of files with existing extensions. Files without extensions will have .handlebars appended to them. This issue is related to the mixing of pure template data with engine configuration options through the Express render API. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: voloko twitter-stream version 0.1.10 voloko twitter-stream version 0.1.16 Description: The issue is related to missing TLS hostname validation, which allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the misuse of eventmachine. Recommendations: For voloko twitter-stream version 0.1.10, consider updating to a version where the TLS hostname validation issue is fixed. For voloko twitter-stream version 0.1.16, consider updating to a version where the TLS hostname validation issue is fixed. As a temporary workaround, consider restricting the use of the eventmachine until a patch is available.

Name of the Vulnerable Software and Affected Versions: TweetStream version 2.6.1 Description: The issue allows an attacker to perform a man-in-the-middle attack due to the insecure use of the eventmachine library, which lacks TLS hostname validation. Recommendations: For TweetStream version 2.6.1, consider disabling the use of the eventmachine library until a secure version is available, or apply a configuration change to enforce TLS hostname validation if possible. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** EM-HTTP-Request version 1.1.5 **Description** The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a TLS server certificate. **Recommendations** For EM-HTTP-Request version 1.1.5, consider updating to a newer version that properly verifies the hostname in TLS server certificates to prevent man-in-the-middle attacks. As a temporary workaround, restrict the use of the eventmachine library until a secure version is available.

**Name of the Vulnerable Software and Affected Versions** em-imap versions 0.5 and earlier **Description** The issue allows an attacker to perform a man-in-the-middle attack against users of the library. This is due to the insecure use of the eventmachine library, which fails to verify the hostname in a TLS server certificate. **Recommendations** For em-imap version 0.5 and earlier, consider updating to a version that securely uses the eventmachine library, ensuring the verification of the hostname in TLS server certificates. As a temporary workaround, restrict the use of the eventmachine library until a secure version is available.

**Name of the Vulnerable Software and Affected Versions** openfortivpn version 1.11.0 **Description** An issue was discovered in openfortivpn when used with OpenSSL before 1.0.2, where the `tunnel.c` file mishandles certificate validation. This occurs because hostname comparisons do not consider '0' characters, making it vulnerable to attacks such as a good.example.comx00evil.example.com attack. **Recommendations** For openfortivpn version 1.11.0, consider updating OpenSSL to version 1.0.2 or later to mitigate the risk of exploitation. As a temporary workaround, restrict the use of certificate validation in `tunnel.c` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** openfortivpn version 1.11.0 **Description** An issue was discovered in openfortivpn when used with OpenSSL 1.0.2 or later, where the `tunnel.c` file mishandles certificate validation. This occurs because a negative error code from `X509 check host` is incorrectly interpreted as a successful return value. **Recommendations** For openfortivpn version 1.11.0, consider updating to a newer version that correctly handles certificate validation, or as a temporary workaround, restrict the use of OpenSSL to versions prior to 1.0.2 until a patch is available.

**Name of the Vulnerable Software and Affected Versions** openfortivpn version 1.11.0 **Description** An issue in openfortivpn, when used with OpenSSL 1.0.2 or later, causes the `tunnel.c` component to mishandle certificate validation. This occurs because the hostname check operates on uninitialized memory, resulting in a valid certificate never being accepted, while a malformed certificate may be accepted. **Recommendations** For openfortivpn version 1.11.0, consider updating to a newer version that addresses the certificate validation issue, as the current version may not properly accept valid certificates due to the mishandling of certificate validation in the `tunnel.c` component.