Fcasal

An issue exists where an application calling `AutoSeeded RNG::clear()` followed by `randomize()` with an empty output buffer while the generator is unseeded may cause `AutoSeeded RNG` to mark itself as seeded without consulting the configured entropy source. In builds where `BOTAN HAS SYSTEM RNG` is not defined, the fallback mechanism relies solely on a clock value and process ID, potentially leading to predictable output in subsequent non-empty requests.

The online OCSP client allows a single HTTP redirect when posting an OCSP request to the URI found in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker can redirect the client to perform a blind request to an internal HTTP service that is otherwise unreachable. This leads to blind Server-Side Request Forgery (SSRF), which may impact internal services using non-idempotent GET handlers. Additionally, response timing can act as a coarse internal-service oracle.

Botan's Python binding converts Python strings containing U+0000 to const char* values without consistently rejecting the embedded NUL. This causes the `bcrypt()` and `check bcrypt()` functions to process only the prefix before the NUL character. Consequently, applications may validate a longer password while hashing a shorter effective value, which can lead to a password-policy bypass.

The `ocsp check` command in the command-line interface requests an OCSP (Online Certificate Status Protocol) response from a certificate's Authority Information Access URL but fails to verify the response signature or authorize the signer. This allows a malicious responder or on-path attacker to provide a timely GOOD response with an empty, invalid, or unauthorized signature, which could lead to a revoked certificate being incorrectly validated with an exit status 0 and an OK output.

The Botan C API function `botan block cipher block size()` converts a `size t` block size to an `int` without performing a bounds check. In applications that accept external algorithm parameter strings and utilize the Foreign Function Interface (FFI) raw Electronic Codebook (ECB) mode, an attacker can select the variable-block-size Lion cipher. This causes the reported size to be truncated, leading the caller to allocate insufficient memory, which subsequently results in memory corruption during block processing. The C++ API and standard C API modes, such as Cipher Block Chaining (CBC) and Counter (CTR), are not affected.

Improper path handling allows a malicious sender to expand the scope of `--delete` operations beyond the intended destination subtree. By sending a crafted file list, an attacker can cause the receiver to reclassify implied parent directory entries or treat synthetic paths as the transfer root. This can be achieved through multiple methods, including implied parent reclassification, synthetic root path construction, non-directory root handling, and legacy protocol behavior below version 30, ultimately resulting in the deletion of files outside the authorized destination directory.

An arbitrary file write issue exists where attackers can write files outside the intended destination tree. This occurs by specifying an absolute path through the `--temp-dir` or `--link-dest` options, which bypasses the rename-confinement logic. This allows attacker-controlled values to write files to any location accessible to the rsync process.

A symlink race condition exists in the `--remove-source-files` feature. This occurs when an attacker with symlink creation access atomically substitutes a symlink for a source file between the completion of the transfer and the `unlink()` function call. This action causes the software to delete the symlink target instead of the intended source file, leading to arbitrary file deletion.

A denial of service issue exists where a remote sender can exhaust system resources on the receiver. This occurs because the short alias `--zt` for the `--compress-threads` option bypasses the string matching of the refuse options directive, which only checks long option names. An attacker can provide a large value for the `--zt` variable to spawn an unbounded number of Zstandard worker threads, leading to the exhaustion of available memory and thread resources.