Davidrxchester

A bug in the CRI plugin allows the restoration of `container.log` from a checkpoint image without validating a symlinked path. This can lead to an arbitrary file read on the host system when using `kubectl logs`.

The software contains a Server-Side Request Forgery (SSRF) issue within the OCI registry token exchange process. When retrieving a model, the software does not properly validate the scheme, hostname, or IP range of the realm URL obtained from the registry's `WWW-Authenticate` header. This allows a malicious OCI registry to redirect requests to internal URLs, such as `http://127.0.0.1:3000/`, enabling arbitrary GET requests to internal services. The response from these internal services is then returned to the caller, and data can be relayed back to the attacker-controlled registry via the `Authorization: Bearer` header.

A flaw exists in the Bluetooth Low Energy Interface component of the software. This issue results in missing authentication. Exploitation is possible within a local network. The exploit has been published. The vendor was contacted regarding this disclosure but did not respond.