Bzimport

A flaw exists in the Fine-Grained Admin Permissions (FGAP) v2 implementation within the administrative services. When FGAP v2 is enabled, the system does not correctly filter child groups based on the caller's permissions when accessed via a parent group. This allows a delegated administrator to bypass permission filters and view details of child groups they are not authorized to access, including group names, paths, and custom attributes.

A flaw in the `http proxies controller` and `http proxy` files allows attackers to perform a Server-Side Request Forgery (SSRF) attack. SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location. This issue can be exploited by modifying HTTP parameters to steal cloud metadata service information within AWS, GCP, or Azure environments.

An issue exists that allows authenticated users to bypass authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. An attacker can gain unauthorized access to protected resources by including the configured access-denied page path within a request URL, either as a path segment or a query parameter.

A flaw exists where the `WSDLReaderAccessor` creates a wsdl4j `WSDLReader` without disabling the `javax.wsdl.importDocuments` feature. When the `VALIDITY` rule is set to FULL, a user with Developer-role access can upload a WSDL document containing malicious import locations. This leads to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making unauthorized HTTP requests to arbitrary internal URLs.

A flaw exists in the RPC message attribute parsing process. The functions `p11 rpc message get attribute()` and `p11 rpc message get attribute array value()` create a mutually-recursive call chain that lacks a recursion depth limit when handling nested `CKA WRAP TEMPLATE`, `CKA UNWRAP TEMPLATE`, and `CKA DERIVE TEMPLATE` attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can trigger stack exhaustion—a condition where the program's call stack overflows—by sending a specially crafted request with deeply nested template attributes, resulting in the crash of the p11-kit server process and its dependent services.

The HTJ2K (High-Throughput JPEG 2000) decoder in OpenEXRCore contains a heap-buffer-overflow READ in the `ht undo impl()` function. This occurs because the function copies decoded pixels from a per-line OpenJPH buffer using the EXR channel's declared width as the iteration count without validating if the codestream embedded in the EXR chunk has smaller tile or line dimensions than those advertised in the EXR header. Consequently, the function reads 32-bit samples from `cur line->i32[]` beyond the actual length of the OpenJPH line buffer. A specially crafted EXR file can trigger a 4-byte heap-buffer-overflow READ following a buffer allocated by `ojph::local::codestream::finalize alloc()`. This issue is reachable via the standard scanline-decode entry point used by any application opening untrusted EXR files, such as thumbnailers, asset pipelines, and the exrcheck utility, leading to a deterministic crash (Denial of Service) and potential adjacent-heap leak.

An issue allows for the resolution of environment variables in AI Gateway secrets, enabling the exfiltration of sensitive server-side environment credentials to an attacker-controlled endpoint. This occurs because the `api key` field in gateway secrets accepts `$ENV VAR` references, which the MLflow server resolves during runtime and sends in provider authentication headers to the configured upstream `api base`. The flaw can be exploited by unauthenticated users in default deployments or low-privileged authenticated users in basic-auth deployments. Potential impacts include the leakage of cloud artifact credentials such as `AWS ACCESS KEY ID` and `AWS SECRET ACCESS KEY`, which may lead to artifact poisoning and cross-boundary code execution in downstream environments.

The assisted-service writes raw referenced pull-secret contents into the `InfraEnv.status.conditions[].message` field when pull-secret validation fails. This allows a namespace principal with the `view` ClusterRole to recover `.dockerconfigjson` data, including `username`, `password`, `email`, and base64 `auth` fields, by reading `InfraEnv` objects. This behavior bypasses the Kubernetes/OpenShift Role-Based Access Control (RBAC) separation between read-only namespace viewers and Secret readers.

A heap out-of-bounds write flaw, dubbed PixelSmash, exists in the `libavcodec` library, specifically within the MagicYUV decoder. The issue stems from a rounding mismatch in the slice handling code where improper validation of the `slice height` variable allows an attacker to manipulate buffer memory. By providing a specially crafted media file in AVI, MKV, or MOV format (as small as 50 KB), a remote attacker can cause a denial-of-service or execute arbitrary code. Technical exploitation involves overflowing the chroma plane buffer to overwrite the `AVBuffer` structure, which contains a function pointer. By replacing this pointer with the address of the `system()` function and providing a shell command, the attacker can achieve remote code execution during normal frame cleanup when `av frame unref()` is called. This can be triggered without user interaction (zero-click) through automatic media library scanning, metadata extraction, or thumbnail generation in applications such as Jellyfin, Nextcloud, Kodi, Emby, Immich, and OBS Studio. The vulnerability is considered a supply chain risk due to the widespread integration of `libavcodec` across various media servers, cloud platforms, and IoT devices.

An access control flaw exists in the OpenID Connect (OIDC) token introspection endpoint. This issue allows a confidential client with valid credentials to bypass audience restrictions and retrieve sensitive token claims intended for other resource servers, which compromises the confidentiality of lightweight access tokens. The flaw can be exploited remotely by any confidential client within the realm.

Traefik's Kubernetes Gateway API provider contains an authorization bypass that allows a tenant with `HTTPRoute` creation permissions to expose the REST provider handler. This occurs because the Gateway provider accepts any `TraefikService` backend reference ending with `@internal`, enabling traffic to be routed to `rest@internal` instead of only the intended `api@internal`. In shared Gateway deployments where the REST provider is enabled, a low-privileged actor can bypass the `providers.rest.insecure=false` setting to gain live dynamic configuration write access via the 'PUT /api/providers/rest' endpoint. This access allows for the unauthorized reconfiguration of routers and services.

Multiple flaws exist in `named` regarding the handling of DNS messages where the CLASS is not Internet (`IN`), such as `CHAOS` or `HESIOD`, or messages specifying meta-classes like `ANY` or `NONE` in the question section. Specially crafted requests targeting code paths related to recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or the processing of `IN`-specific record types in non-`IN` data can trigger assertion failures in `named`.

An attacker can cause uncontrolled memory usage via excessive bracing over IMAP. A previous fix was incomplete as it only blocked closing braces, allowing the memory limit to be bypassed using open braces. This can lead to memory consumption reaching the configured limit.

A Use-After-Free (UAF) issue exists in the rxrpc component. If the `skb unshare()` function fails to unshare a packet due to an allocation failure within `rxrpc input packet()`, the skb pointer in the parent function `rxrpc io thread()` is set to NULL. This sequence leads to a system oops when `trace rxrpc rx done()` is called.

A denial of service issue exists in the multipart part header parsing of the `MultipartParser` when processing `multipart/form-data`. The parser lacked limits on the number of part headers and the size of individual part headers. An attacker could cause excessive CPU work, leading to CPU exhaustion and potential worker or event-loop delays in ASGI applications using frameworks like Starlette or FastAPI, by sending a request with a single very large header value or many repeated headers without terminating the header block. The affected parser states include `HEADER FIELD START`, `HEADER FIELD`, `HEADER VALUE START`, `HEADER VALUE`, and `HEADER VALUE ALMOST DONE`.

A race condition exists in the `ChownProblemDir` method of the abrt-dbus D-Bus service. The `ChownProblemDir` method opens the dump directory using `DD OPEN READONLY` and executes `dd chown()` to change the ownership of all files to the user ID of the caller. This process can succeed even when post-create event handlers maintain a write lock, enabling an attacker to obtain filesystem-level control of the dump directory while privileged event scripts are still active.

A flaw exists where permitted name constraints are incorrectly ignored when previous Certificate Authorities (CAs) only have excluded name constraints. A remote attacker can exploit this to bypass critical name constraint checks during certificate validation, which may lead to the acceptance of invalid certificates and enable spoofing or man-in-the-middle attacks.

A buffer over-read occurs during outbound OCSP (Online Certificate Status Protocol) requests sent to an attacker-controlled OCSP server. A buffer over-read is a condition where a system reads data past the end of the intended buffer, potentially exposing sensitive information from memory.

A use-after-free issue exists in the DOM: Core & HTML component. Use-after-free is a memory corruption flaw that occurs when an application continues to use a pointer after it has been freed.

A flaw exists in the netfilter component of the Linux kernel, specifically within the Network Address Translation (NAT) subsystem. The issue stems from improper memory management when releasing network filter operation structures. This can lead to a system crash resulting in a Denial of Service (DoS) or the unauthorized exposure of sensitive internal hook data during error handling. The problem is particularly relevant when dumping active netfilter hooks from userspace, as the `nf nat register fn()` function may partially expose hooks during the error path.