Jro-Calif

The access-log formatter in the HTTP server can write past its log-line buffer when a custom access-log format is configured. This occurs due to allocation errors involving `%{error}x`, `%q` when the query string is empty, and numeric elements where the temporary terminating NUL reaches the end of the buffer. A specifically crafted request can cause the server to crash, although the impact of a one-byte NUL overwrite beyond a crash has not been determined.

An unsafe deserialization issue exists in the client-side Shared-Project RMI connection code, enabling unauthenticated remote code execution. An attacker can create a malicious project file containing a `ghidra://` URL. When this file is opened through the File → Open Project menu, the application deserializes untrusted objects using a Jython 2.7.4 gadget chain—a sequence of executable code fragments—to run arbitrary commands.

An authentication bypass exists in the `PKIAuthenticationModule.authenticate()` function. This issue allows any user possessing a valid CA-signed certificate to impersonate other users by presenting their public certificate with a null signature. Successful exploitation can lead to privilege escalation, modification of repository access controls, exfiltration of shared reverse engineering databases, and permanent compromise of server integrity.