Bugbunny.Ai

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.0.0 through 2.0.9 **Description** An issue involving uncontrolled recursion and resource consumption exists in the IoTDB AirGap receiver. When the `pipe air gap receiver enabled` variable is set to true, the `readLength()` function calls itself recursively without a depth limit whenever it recognizes the E-language prefix in socket data. An unauthenticated attacker can exploit this by sending a stream of repeated E-language prefixes, causing the JVM stack of the receiver thread to be exhausted and triggering a StackOverflowError. **Recommendations** Upgrade to version 2.0.10. As a temporary mitigation, set the `pipe air gap receiver enabled` variable to false to disable the affected receiver.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.3.5 through 1.3.7 Apache IoTDB versions 2.0.5 through 2.0.9 **Description** Incorrect authorization and improper access control allow authenticated users to bypass authorization at the '/rest/v2/fastLastQuery' endpoint, exposing last-value data. **Recommendations** Upgrade Apache IoTDB versions 1.3.5 through 1.3.7 to version 1.3.8. Upgrade Apache IoTDB versions 2.0.5 through 2.0.9 to version 2.0.10.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB C++ client versions 1.3.5 through 1.3.7 Apache IoTDB C++ client versions 2.0.5 through 2.0.9 **Description** An out-of-bounds read and improper input validation issue exists in the `TsBlock` deserializer. This occurs when the client processes malformed data sent by the server, which can lead to a crash of the client process. **Recommendations** Upgrade Apache IoTDB C++ client versions 1.3.5 through 1.3.7 to version 1.3.8. Upgrade Apache IoTDB C++ client versions 2.0.5 through 2.0.9 to version 2.0.10.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 1.0.0 through 2.0.9 **Description** An issue exists in the IoTDB AirGap pipe receiver when the `pipe air gap receiver enabled` variable is set to true. The receiver accepts raw TCP connections on port 9780 without authentication. The `readLength()` function reads a 32-bit integer from the socket, which is then passed to `readData()` and used to allocate a byte array `new byte[length]` without an upper-bound check. An unauthenticated attacker can provide a large value, forcing the JVM to attempt an allocation of up to 2,147,483,647 bytes per connection, leading to heap memory exhaustion and causing the DataNode process to crash or severely degrade. **Recommendations** Upgrade to version 2.0.10. As a temporary mitigation, set the `pipe air gap receiver enabled` variable to false to disable the vulnerable receiver.

**Name of the Vulnerable Software and Affected Versions** Apache IoTDB versions 2.0.8 through 2.0.9 **Description** Improper Privilege Management and Improper Access Control allow authenticated users to escalate their privileges to obtain full tree-path access. This is achieved by renaming the user account to ` internal auditor`. **Recommendations** Upgrade to version 2.0.10.

**Name of the Vulnerable Software and Affected Versions** apache-airflow versions prior to 3.3.0 **Description** A bug in the `BaseSerialization.deserialize()` function allows unrestricted `import string()` of attacker-controlled class paths when the Scheduler or API Server loads a serialized DAG. A DAG author can embed a malicious trigger into a DAG to achieve remote code execution on the API Server or Scheduler process, bypassing the security boundary that prevents DAG-author code from executing within those processes. **Recommendations** Upgrade to apache-airflow version 3.3.0 or later. Restrict the `[core] allowed deserialization classes` configuration to a narrow allowlist in deployments where trust in DAG authors is limited.

**Name of the Vulnerable Software and Affected Versions** Apache Artemis versions 2.50.0 through 2.53.0 Apache ActiveMQ Artemis versions 2.0.0 through 2.44.0 **Description** An issue exists where an application using the STOMP (Simple Text Oriented Messaging Protocol) protocol can augment the routing-type of an address. This occurs when security credentials grant either consume or send permissions on an address, allowing the user to perform these operations with a routing-type not supported by the address, even without the `createAddress` permission. Normally, such operations should be rejected if the user lacks the permission to change the routing-type. **Recommendations** Upgrade Apache Artemis to version 2.54.0. Upgrade Apache ActiveMQ Artemis to version 2.54.0.