Jrhee17

**Name of the Vulnerable Software and Affected Versions** centraldogma-server-mirror-git versions prior to 0.84.0 **Description** The Git mirror SSH client fails to verify remote host keys for `git+ssh://` connections. This allows an on-path attacker to conduct man-in-the-middle attacks, which can lead to the compromise of mirrored repositories. **Recommendations** Update to version 0.84.0 or later.

**Name of the Vulnerable Software and Affected Versions** centraldogma-server versions prior to 0.84.0 **Description** Enabling ZooKeeper replication without configuring the `replication.secret` variable causes the server to silently use a hard-coded, publicly known secret. This default credential authenticates the embedded ZooKeeper ensemble, which allows an attacker with network access to read the complete replication log or join the quorum to execute arbitrary replicated commands across the cluster. **Recommendations** Update to version 0.84.0 or later. Ensure the `replication.secret` variable is explicitly set when enabling ZooKeeper replication.

**Name of the Vulnerable Software and Affected Versions** centraldogma-server-auth-shiro versions prior to 0.84.0 **Description** An issue exists in the `SearchFirstActiveDirectoryRealm` where the login username is substituted into an LDAP search filter without neutralizing LDAP filter metacharacters. This allows an unauthenticated attacker to manipulate the filter, leading to authentication confusion and the ability to enumerate the directory structure. LDAP injection occurs when an application fails to properly sanitize user-supplied input used in a Lightweight Directory Access Protocol (LDAP) query. **Recommendations** Update to version 0.84.0 or later.

**Name of the Vulnerable Software and Affected Versions** armeria-xds versions 1.38.0 through 1.39.0 **Description** `DataSourceStream` in the xDS module resolves `filename` and `environment variable` fields from SDS Secret resources without an allow-list or base-directory confinement. This allows a compromised or semi-trusted xDS control plane, or an attacker performing a man-in-the-middle attack on SDS responses, to read arbitrary local files and environment variables on the xDS client host. This information disclosure can be used to exfiltrate sensitive data such as TLS private keys, system files, cloud credentials, and database tokens. The issue is located in the `xds/src/main/java/com/linecorp/armeria/xds/DataSourceStream.java` component. **Recommendations** Update to version 1.40.0. Ensure the xDS control plane channel is authenticated and encrypted using mTLS to prevent the injection of malicious SDS responses. Run the xDS client with minimal filesystem permissions and a restricted environment to limit the impact of arbitrary reads. Use inline `DataSource` bytes delivered over the SDS stream instead of file-based secrets and audit control-plane configurations to ensure no `filename` or `environment variable` DataSources are present.