Davidkorczynski

**Name of the Vulnerable Software and Affected Versions** rsyslog (affected versions not specified) **Description** An unauthenticated remote attacker can cause a denial of service (DoS) by triggering a heap buffer overflow. This occurs when the RainerScript `replace()` function incorrectly calculates the buffer size during string replacement while processing specially crafted syslog messages, resulting in memory corruption. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Ceph versions prior to 20.2.4 Ceph versions prior to 19.2.6 **Description** The Monitor subscription handler fails to properly authorize access to the configuration-key store. A CephX user with `mon allow r` capabilities can read the entire store by sending a crafted MMonSubscribe message. The configuration-key store contains sensitive secrets, such as OSD LUKS disk-encryption passphrases and the SSH private key used by cephadm to access hosts in the cluster. Under default cephadm configurations, this key provides root access to every node, allowing a low-privileged read-only account to achieve full cluster and host compromise. **Recommendations** Update to version 20.2.4 or later. Update to version 19.2.6 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.30.0 **Description** A server-side authentication bypass exists in the RDSTLS handshake when the server is configured with `RdstlsSecurity = TRUE`. The handshake dispatches inbound PDUs based on the attacker-supplied `pduType` without verifying if the PDU is required for the current step. Since the `rdpRdstls` object is calloc-zeroed, the `resultCode` defaults to 0 (`RDSTLS RESULT SUCCESS`). An unauthenticated remote client can send a Capabilities PDU instead of the required Authentication Request PDU. The function `rdstls process capabilities()` returns success without setting the `resultCode`, leading the server to respond with an `AUTHRSP` carrying a success code and treating the session as authenticated without verifying passwords, redirection GUIDs, or auto-reconnect cookies. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.30.0 **Description** A heap-based buffer overflow exists in the Windows clipboard client's `CliprdrStream Read()` function. The issue occurs when an OLE paste consumer calls `IStream::Read` with a fixed-size buffer of `cb` bytes; the `CliprdrStream Read()` function then copies the response from the RDP server using the server-supplied length `req fsize` instead of the `cb` value. A compromised RDP server can send an oversized `CB FILECONTENTS RESPONSE`, leading to an out-of-bounds write of attacker-controlled data into the paste consumer's heap buffer during a clipboard paste operation. **Recommendations** Update to version 3.30.0 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.30.0 **Description** A heap-based out-of-bounds vulnerability exists in the `kerberos DecryptMessage()` function within the `winpr/libwinpr/sspi/Kerberos/kerberos.c` file. The issue occurs because the 16-bit EC (extra count) field of a peer-supplied GSS Wrap token is used in pointer arithmetic to locate encrypted regions without proper bounds checking. A malicious peer can provide a large EC value during CredSSP/NLA authentication, causing the decryption operation's base pointers to move beyond the end of the token buffer. Since AES-CTS-HMAC enctypes perform decryption in place before the HMAC integrity check, this leads to out-of-bounds read and write operations, which may result in information disclosure, memory corruption, or denial of service. **Recommendations** Update to version 3.30.0 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.28.0 **Description** A heap-based buffer overflow exists in the `crypto rsa common()` function within the `libfreerdp/crypto/crypto.c` file. The issue occurs because the function uses `BN bn2bin()` to write a modular-exponentiation result into the output buffer before validating if `output length` exceeds `out length`. When the server is configured with RDP Standard Security, an unauthenticated remote attacker can send a crafted encrypted client random. Since the server publishes its RSA public key, the attacker can forge a ciphertext that decrypts to a value up to the full modulus length (e.g., 256 bytes for RSA-2048), overflowing the fixed 32-byte heap buffer by approximately 224 bytes. This can lead to a denial of service or potentially allow the execution of arbitrary code. **Recommendations** Update FreeRDP to version 3.28.0.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions 3.x through 3.27.1 **Description** A double-free issue exists in the `freerdp client rdp file apply to settings()` function (located in `client/common/file.c`) when parsing the `selectedmonitors` field of a .rdp connection file. The `MonitorIds` array is allocated via the settings object, but a raw non-owning pointer to it is freed during a `strtoul` error path without clearing `settings->MonitorIds`. This leaves a dangling pointer, which is then freed again by `freerdp settings free()` during teardown. A remote attacker can trigger this size-controlled double-free in FreeRDP CLI clients such as xfreerdp, sdl-freerdp, or wlfreerdp by convincing a user to open a specially crafted .rdp file containing oversized monitor tokens. **Recommendations** Update FreeRDP to version 3.28.0 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.28.0 **Description** FreeRDP treats lines starting with a forward slash in RDP files as raw command-line options, which exposes the entire CLI parser surface to untrusted files. This allows attackers to use malicious RDP files containing options such as `/rdp2tcp`, `/cert:ignore`, or `/drive` to execute arbitrary commands, bypass certificate validation, or expose local filesystems without user interaction. **Recommendations** Update FreeRDP to version 3.28.0 or later.

**Name of the Vulnerable Software and Affected Versions** Ruby JSON versions 2.14.0 through 2.15.2.0 Ruby JSON versions 2.17.0 through 2.17.1.1 Ruby JSON versions 2.19.0 through 2.19.1 **Description** A format string injection flaw exists when processing specially crafted user-supplied documents while the `allow duplicate key: false` parsing option is enabled. This can allow a remote attacker to cause a denial of service (DoS) or disclose sensitive information. **Recommendations** Update Ruby JSON to version 2.15.2.1. Update Ruby JSON to version 2.17.1.2. Update Ruby JSON to version 2.19.2. As a temporary workaround, avoid using the `allow duplicate key: false` parsing option.

**Name of the Vulnerable Software and Affected Versions** Cosign versions prior to 2.2.4 **Description** Cosign provides code signing and transparency for containers and binaries. Maliciously-crafted software artifacts can cause denial of service of the machine running Cosign, thereby impacting all services on the machine. The root cause is that Cosign creates slices based on the number of signatures, manifests or attestations in untrusted artifacts. As such, the untrusted artifact can control the amount of memory that Cosign allocates. The exact issue is Cosign allocates excessive memory on the lines that creates a slice of the same length as the manifests. **Recommendations** Update to version 2.2.4 or later, where the number of attestations, signatures, and manifests has been limited to a reasonable value. As a temporary workaround, consider restricting the use of untrusted artifacts to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Crossplane versions prior to 1.11.5 Crossplane versions prior to 1.12.3 Crossplane versions prior to 1.13.0 **Description** Crossplane's image backend does not validate the byte contents of Crossplane packages, allowing an attacker to tamper with a package without detection. The issue has been fixed in versions 1.11.5, 1.12.3, and 1.13.0. As a workaround, users should only use images from trusted sources and keep package editing/creating privileges restricted to administrators. **Recommendations** For versions prior to 1.11.5, update to version 1.11.5 or later. For versions prior to 1.12.3, update to version 1.12.3 or later. For versions prior to 1.13.0, update to version 1.13.0 or later. As a temporary workaround, consider only using images from trusted sources and restricting package editing/creating privileges to administrators only.

**Name of the Vulnerable Software and Affected Versions** Crossplane versions prior to 1.11.5 Crossplane versions prior to 1.12.3 Crossplane versions prior to 1.13.0 **Description** A high-privileged user could create a Package referencing an arbitrarily large image, which Crossplane would then parse, possibly resulting in exhausting all the available memory and therefore in the container being OOMKilled. The impact is limited due to the high privileges required to create the Package and the eventually consistency nature of the controller. **Recommendations** For versions prior to 1.11.5, update to version 1.11.5 or later. For versions prior to 1.12.3, update to version 1.12.3 or later. For versions prior to 1.13.0, update to version 1.13.0 or later. As a temporary workaround, consider using images from trusted sources and keeping Package editing/creating privileges to administrators only.

**Name of the Vulnerable Software and Affected Versions** Rekor versions prior to 1.1.1 **Description** Rekor is an open source software supply chain transparency log that may crash due to out of memory (OOM) conditions caused by reading archive metadata files into memory without checking their sizes first. Verification of a JAR file submitted to Rekor can cause an out of memory crash if files within the META-INF directory of the JAR are sufficiently large. Parsing of an APK file submitted to Rekor can cause an out of memory crash if the .SIGN or .PKGINFO files within the APK are sufficiently large. **Recommendations** Update to Rekor version 1.1.1 to resolve the issue. As a temporary workaround, consider restricting the size of files within the META-INF directory of JAR files and the .SIGN and .PKGINFO files within APK files to prevent out of memory crashes. Avoid submitting JAR or APK files with large files in the META-INF directory or .SIGN and .PKGINFO files to Rekor until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** crossplane-runtime versions prior to 1.11.2 crossplane-runtime versions prior to 1.10.3 crossplane-runtime versions prior to 1.9.2 **Description** The issue affects crossplane-runtime, a set of Go libraries used to build Kubernetes controllers in Crossplane and its related stacks. An already highly privileged user able to create or update Compositions can specify an arbitrarily high index in a patch's `ToFieldPath`, which could lead to excessive memory usage once such Composition is selected for a Composite resource. Compositions allow users to specify patches inserting elements into arrays at an arbitrary index. When a Composition is selected for a Composite Resource, patches are evaluated and if a specified index is greater than the current size of the target slice, Crossplane will grow that slice up to the specified index, which could lead to an excessive amount of memory usage and therefore the Pod being OOM-Killed. **Recommendations** To resolve the issue for versions prior to 1.11.2, upgrade to version 1.11.2 or later. To resolve the issue for versions prior to 1.10.3, upgrade to version 1.10.3 or later. To resolve the issue for versions prior to 1.9.2, upgrade to version 1.9.2 or later. As a temporary workaround, restrict write privileges on Compositions to only admin users.

**Name of the Vulnerable Software and Affected Versions** Helm versions prior to 3.10.3 **Description** The issue concerns a NULL Pointer Dereference in the ` repo ` package of Helm, which can lead to a Denial of Service. The ` repo ` package processes the index file of a repository and loads it into structures that Go can work with. Certain index files can cause array data structures to be created, resulting in a memory violation. When such an index file is encountered, the Helm Client will panic, but since Helm is not a long-running service, this panic will not affect future uses of the Helm client. Applications using the ` repo ` package in the Helm SDK to parse an index file can suffer from this issue when the input causes a panic that cannot be recovered from. **Recommendations** For versions prior to 3.10.3, update to version 3.10.3 to resolve the issue. As a temporary workaround, SDK users can validate index files that are correctly formatted before passing them to the ` repo ` functions.