Gladiator9797

An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content in response to a pull by digest, so that a user runs an image other than the one they pinned. The fix compares the returned digest to the pinned digest and fails the pull on a mismatch. Tag pulls are exempt, because a tag is mutable by design. The fix also verifies the hash of manifests and blobs when they are fetched. This vulnerability is addressed in container version 1.6.0 and containerization version 0.52.1.

When using the stock JDK provider (where Apache Xerces is absent from the classpath), the software fails to block XInclude resource resolution if an application enables XInclude. This occurs when using factories from `XmlFactories.newDocumentBuilderFactory()` or `XmlFactories.newSAXParserFactory()`, or when an `XMLReader` is processed via `XmlFactories.harden()`. An attacker providing untrusted XML can use `xi:include` references to disclose local files or perform server-side request forgery (SSRF) to reach internal network endpoints via `http` references. SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location.

An input validation weakness exists in the IPv6 Neighbor Discovery handlers within `subsys/net/ip/ipv6 nbr.c`. The functions `handle ra input()`, `handle ns input()`, and `handle na input()` use an incorrect boolean expression when combining RFC 4861 validity checks with ICMPv6 code checks. Due to wrong operator precedence, packets with an ICMPv6 code of 0 cause the entire validation predicate to evaluate as false, allowing the system to skip mandatory checks such as the Hop Limit verification and source address validation. This allows an adjacent on-link attacker, or potentially a remote attacker, to send forged Router Advertisement (RA), Neighbor Solicitation (NS), and Neighbor Advertisement (NA) messages. Forged RA messages can be used to reconfigure the default router, on-link prefixes (SLAAC), MTU, timers, and DNS servers. Forged NS and NA messages can lead to neighbor-cache poisoning, enabling man-in-the-middle attacks, traffic redirection, and denial of service.