Cantina

OpenSSL stream peer verification incorrectly handles certificate validation by falling back to the Common Name (CN) when no entries in the `subjectAltName` (SAN) match. According to RFC 6125, the CN should be ignored if the certificate contains any service identity. This behavior allows a certificate trusted for one name to be used to impersonate another if the CN matches the requested `peer name` despite a non-matching DNS SAN.

An improper access check allows privilege escalation through the `com users` batch task.

An app may be able to access sensitive user data due to insufficient data protection.

Processing maliciously crafted web content may prevent Content Security Policy (a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting and data injection) from being enforced.

A validation issue exists where processing maliciously crafted web content may prevent the Content Security Policy (a security layer that helps detect and mitigate certain types of attacks, including Cross-Site Scripting and data injection) from being enforced.

When `SESSION SAVE EVERY REQUEST` is set to `True`, response headers do not vary based on cookies if a session remains unmodified. This allows a remote attacker to steal a user's session after the victim visits a cached public page. This is a session fixation issue where a session identifier can be compromised via public cached content.

Name of the Vulnerable Software and Affected Versions Django versions 6.0 through 6.0.3 Django versions 5.2 through 5.2.12 Django versions 4.2 through 4.2.29 Django versions 5.0.x and earlier Django versions 4.1.x and earlier Django versions 3.2.x and earlier Description An issue was discovered where admin changelist forms using `ModelAdmin.list editable` incorrectly allowed new instances to be created via forged `POST` data. Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected. Recommendations Update to Django version 6.0.4 or later. Update to Django version 5.2.13 or later. Update to Django version 4.2.30 or later.

Name of the Vulnerable Software and Affected Versions swift-crypto versions 4.3.0 and earlier Description A remote attacker can provide a short X-Wing HPKE encapsulated key, triggering an out-of-bounds read in the C decapsulation path. This can lead to a crash or memory disclosure, depending on runtime protections. The issue arises because the X-Wing decapsulation path accepts attacker-controlled ciphertext bytes without enforcing a fixed ciphertext length. The C API expects a fixed-size buffer of 1120 bytes, and a shorter `Data` value passed to it can cause the C code to read beyond the Swift buffer. The vulnerability is reachable through initialization of an `HPKE.Recipient`, where a malformed `encapsulatedKey` can trigger undefined behavior instead of a safe length-validation error. The `decapsulate` function of `OpenSSLXWingPrivateKeyImpl` does not perform a length check before passing the `encapsulated` data to the C API. A Proof of Concept (PoC) demonstrates that providing a 1-byte `encapsulatedKey` instead of the required 1120 bytes does not result in rejection, and can lead to a crash or memory corruption when run with AddressSanitizer. Recommendations Update to swift-crypto version 4.3.1 or later.