Faran Abdullah

An OS command injection issue exists in the handling of the repository `git url` variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by crafting a malicious `git url` value using the `--upload-pack=` option. This occurs when the server processes repository operations using the default `cmd git` client.

An issue was discovered in Fluent Bit when the Prometheus Remote Write input plugin is running and listening on an IP address and port. One can send a packet with `Content-Length: 0` and it crashes the server. Improper handling of the case when `Content-Length` is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the `Content-Length`) is passed to the function `cfl sds len`, which in turn tries to cast a NULL pointer into struct `cfl sds`. This is related to `process payload metrics ng()` at `prom rw prot.c`.

An issue was discovered in Fluent Bit when the OpenTelemetry input plugin is running and listening on an IP address and port. A user with access to the endpoint can send a packet with `Content-Length: 0` and crash the server, allowing for a remote Denial of Service attack. The crash occurs due to a NULL pointer dereference when `0` (from the `Content-Length`) is passed to the function `cfl sds len()`, which tries to cast a NULL pointer into `struct cfl sds`. This is related to the `process payload traces proto ng()` function at `opentelemetry prot.c`.

The issue is related to a heap-based buffer overflow in the zlog library, specifically in the `zlog rule new()` function. This occurs because the size of `record name` is limited to `MAXLEN PATH(1024) + 1`, but `file path` can contain data up to `MAXLEN CFG LINE(MAXLEN PATH*4) + 1`, leading to a missing check when copying `record name` from `file path + 1`. This can cause a buffer overflow, allowing an attacker to potentially overwrite the `zlog record fn` `record func` function pointer, resulting in arbitrary code execution or remote code execution (RCE).