Chenjj

**Name of the Vulnerable Software and Affected Versions** Caddy versions 2.7.0 through 2.11.2 **Description** The FastCGI transport's `splitPos()` function in `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go` misuses the `search.IgnoreCase` feature of the `golang.org/x/text/search` library when a request path contains non-ASCII bytes. This leads to two flaws: a control-flow issue where a stale `match` variable allows non-script files to be treated as scripts, and a Unicode equivalence issue where non-ASCII lookalike characters are folded into ASCII characters (e.g., treating `.𝗽𝗵𝗽` as `.php`). In deployments where an attacker can upload or place content into files served via FastCGI, these flaws can be exploited by crafting a specific URL to achieve remote code execution. **Recommendations** Update to version 2.11.3.

**Name of the Vulnerable Software and Affected Versions** go-jose versions prior to 2.6.3 go-jose versions prior to 3.0.3 go-jose versions prior to 4.0.1 **Description** The issue is related to the incorrect handling of highly compressed input data in the go-jose package, which implements the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by `Decrypt` or `DecryptMulti` functions. These functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). **Recommendations** For versions prior to 2.6.3, update to version 2.6.3 or later. For versions prior to 3.0.3, update to version 3.0.3 or later. For versions prior to 4.0.1, update to version 4.0.1 or later. As a temporary workaround, consider restricting the use of the `Decrypt` and `DecryptMulti` functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Gevent versions prior to 23.9.1 Gevent version 23.9.0 **Description** The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted script. This can impact the integrity, availability, and confidentiality of protected information. **Recommendations** For Gevent versions prior to 23.9.1, update to version 23.9.1 or later to resolve the issue. For Gevent version 23.9.0, update to version 23.9.1 to resolve the issue. As a temporary workaround, consider restricting access to the WSGIServer component until a patch is available.

Name of the Vulnerable Software and Affected Versions: Yii versions 2.x through 2.0.15.1 Description: The issue arises from the active conversion of a wildcard CORS policy into reflecting an arbitrary Origin header value. This behavior is incompatible with the CORS security design and could lead to CORS misconfiguration security problems. Recommendations: For versions 2.x through 2.0.15.1, consider disabling the automatic conversion of wildcard CORS policies to prevent reflecting arbitrary Origin header values until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.