Joseph Surin

**Name of the Vulnerable Software and Affected Versions** RedisBloom versions prior to 2.8.20 **Description** RedisBloom, a probabilistic data structures module for Redis, fails to properly validate serialized values processed via the 'RESTORE' command. An authenticated attacker with permissions to execute 'RESTORE' on a server where the module is loaded can provide a crafted serialized payload to trigger invalid memory access, which may result in remote code execution. **Recommendations** Update to version 2.8.20. Restrict access to the 'RESTORE' command using ACL rules as a temporary workaround.

**Name of the Vulnerable Software and Affected Versions** ESP-IDF versions prior to 4.4.7 ESP-IDF versions prior to 5.2.1 **Description** A Time-of-Check to Time-of-Use (TOCTOU) vulnerability was discovered in the implementation of the ESP-IDF bootloader, which could allow an attacker with physical access to flash of the device to bypass anti-rollback protection. This attack can allow booting past a partition with a lower security version, even in the presence of a flash encryption scheme. The vulnerability requires carefully modifying the flash contents after the anti-rollback checks have been performed by the bootloader. **Recommendations** For ESP-IDF versions prior to 4.4.7, update to version 4.4.7 or later. For ESP-IDF versions prior to 5.2.1, update to version 5.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** Apache Guacamole versions 1.5.3 and older **Description** The issue arises from inconsistent handling of values received from a VNC server, which can lead to integer overflow. If a user connects to a malicious or compromised VNC server, specially-crafted data could result in memory corruption, possibly allowing arbitrary code to be executed with the privileges of the running guacd process. Approximately 29,620 results are mainly distributed in the United States, Germany, and other countries. **Recommendations** For Apache Guacamole versions 1.5.3 and older, upgrade to version 1.5.4, which fixes this issue. As a temporary workaround, consider restricting access to the VNC server to minimize the risk of exploitation. Avoid using potentially malicious or compromised VNC servers until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Home Assistant Supervisor versions 2023.01.1 and earlier Home Assistant Core versions prior to 2023.3.0 **Description** A remotely exploitable issue has been discovered in Home Assistant, allowing unauthorized access to the Supervisor API by bypassing authentication. This affects all Home Assistant installations using the Supervisor 2023.01.1 or older, excluding installations like Home Assistant Container or Home Assistant Core in a Python environment. The issue has been mitigated in Supervisor version 2023.03.1 and Home Assistant Core 2023.3.0. **Recommendations** For Home Assistant Supervisor versions 2023.01.1 and earlier, upgrade to at least version 2023.03.1. For Home Assistant Core versions prior to 2023.3.0, upgrade to at least version 2023.3.0. As a temporary workaround, consider not exposing your Home Assistant instance to the internet until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Libksba versions prior to 1.6.3 **Description** The issue is related to an integer overflow vulnerability in the CRL signature parser. This vulnerability can be exploited by a remote attacker to send specially crafted data to the application, causing an integer overflow and potentially allowing the execution of arbitrary code on the target system. **Recommendations** For versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue. As a temporary workaround, consider restricting the use of the CRL signature parser until a patch is available.