Akshayjaing

When the `use csr sans` setting is enabled, the software fails to enforce the `allowed ip sans cidr` restriction on IP Subject Alternative Names (SANs) extracted from a Certificate Signing Request (CSR). Authenticated users with sign permissions can submit a CSR containing an out-of-range IP SAN to the 'pki/sign/<role>' endpoint to obtain CA-signed certificates for unauthorized IP addresses.

LibJWT, a C JSON Web Token Library, has an issue in the RSA-PSS JWK parsing functionality. Versions prior to 3.3.0 do not adequately validate JSON string values, specifically failing to protect against NULL values. A crafted JWK file containing integers where strings are expected can exploit this. It is recommended to avoid importing keys from untrusted sources and to use the `jwk2key` tool to validate JWK files. If possible, avoid using JWK files with RSA-PSS keys.

The software is susceptible to Regular Expression Denial of Service (ReDoS) when processing glob patterns containing numerous consecutive `*` wildcards followed by a literal character absent from the input string. Each `*` translates into a separate `[^/]*?` regex group, causing exponential backtracking in V8's regex engine upon match failure. The time complexity escalates to O(4^N), where `N` represents the number of `*` characters. A single call to `minimatch()` can take approximately 2 seconds with N=15 and effectively hang with N=34. Applications utilizing user-supplied strings as pattern arguments for the `minimatch()` function are vulnerable to Denial of Service.