Chenjj

The FastCGI transport's `splitPos()` function in `modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go` misuses the `search.IgnoreCase` feature of the `golang.org/x/text/search` library when a request path contains non-ASCII bytes. This leads to two flaws: a control-flow issue where a stale `match` variable allows non-script files to be treated as scripts, and a Unicode equivalence issue where non-ASCII lookalike characters are folded into ASCII characters (e.g., treating `.𝗽𝗵𝗽` as `.php`). In deployments where an attacker can upload or place content into files served via FastCGI, these flaws can be exploited by crafting a specific URL to achieve remote code execution.

The issue is related to the incorrect handling of highly compressed input data in the go-jose package, which implements the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by `Decrypt` or `DecryptMulti` functions. These functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger).

The issue in Gevent is related to insufficient validation of executed requests in the WSGIServer component, allowing a remote attacker to escalate privileges via a crafted script. This can impact the integrity, availability, and confidentiality of protected information.

Name of the Vulnerable Software and Affected Versions: Yii versions 2.x through 2.0.15.1 Description: The issue arises from the active conversion of a wildcard CORS policy into reflecting an arbitrary Origin header value. This behavior is incompatible with the CORS security design and could lead to CORS misconfiguration security problems. Recommendations: For versions 2.x through 2.0.15.1, consider disabling the automatic conversion of wildcard CORS policies to prevent reflecting arbitrary Origin header values until a patch is available. Restrict access to sensitive resources to minimize the risk of exploitation.