Faran Abdullah

**Name of the Vulnerable Software and Affected Versions** Semaphore versions prior to 2.18.20 **Description** An OS command injection issue exists in the handling of the repository `git url` variable. Authenticated users with Manager or Owner roles can achieve remote code execution on the server host by crafting a malicious `git url` value using the `--upload-pack=` option. This occurs when the server processes repository operations using the default `cmd git` client. **Recommendations** Update Semaphore to version 2.18.20 or later.

**Name of the Vulnerable Software and Affected Versions** Fluent Bit version 3.1.9 **Description** An issue was discovered in Fluent Bit when the Prometheus Remote Write input plugin is running and listening on an IP address and port. One can send a packet with `Content-Length: 0` and it crashes the server. Improper handling of the case when `Content-Length` is 0 allows a user (with access to the endpoint) to perform a remote Denial of service attack. The crash happens because of a NULL pointer dereference when 0 (from the `Content-Length`) is passed to the function `cfl sds len`, which in turn tries to cast a NULL pointer into struct `cfl sds`. This is related to `process payload metrics ng()` at `prom rw prot.c`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Fluent Bit version 3.1.9 **Description** An issue was discovered in Fluent Bit when the OpenTelemetry input plugin is running and listening on an IP address and port. A user with access to the endpoint can send a packet with `Content-Length: 0` and crash the server, allowing for a remote Denial of Service attack. The crash occurs due to a NULL pointer dereference when `0` (from the `Content-Length`) is passed to the function `cfl sds len()`, which tries to cast a NULL pointer into `struct cfl sds`. This is related to the `process payload traces proto ng()` function at `opentelemetry prot.c`. **Recommendations** As a temporary workaround, consider disabling the OpenTelemetry input plugin until a patch is available. Restrict access to the vulnerable endpoint to minimize the risk of exploitation. Avoid sending packets with `Content-Length: 0` to the affected server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** zlog versions 1.1.0 through 1.2.17 **Description** The issue is related to a heap-based buffer overflow in the zlog library, specifically in the `zlog rule new()` function. This occurs because the size of `record name` is limited to `MAXLEN PATH(1024) + 1`, but `file path` can contain data up to `MAXLEN CFG LINE(MAXLEN PATH*4) + 1`, leading to a missing check when copying `record name` from `file path + 1`. This can cause a buffer overflow, allowing an attacker to potentially overwrite the `zlog record fn` `record func` function pointer, resulting in arbitrary code execution or remote code execution (RCE). **Recommendations** For zlog versions 1.1.0 through 1.2.17, as a temporary workaround, consider disabling the `zlog rule new()` function until a patch is available. Restrict access to the `zlog rule s` class to minimize the risk of exploitation. Avoid using overly long strings for user-defined outputs in configuration files to prevent buffer overflow. At the moment, there is no information about a newer version that contains a fix for this vulnerability.