Kocaemre

**Name of the Vulnerable Software and Affected Versions** Wazuh versions 4.0.0 through 4.14.6 **Description** A malicious or man-in-the-middle enrollment manager can cause a denial of service by crashing a Wazuh agent during the enrollment process. This occurs when the manager returns a malformed key response containing fewer than four fields, leading to a NULL pointer dereference. The `w enrollment process agent key()` routine splits the key into four space-separated fields but fails to verify their presence before validation. Specifically, `OS StrBreak()` leaves missing trailing entries as NULL, and `OS IsValidName()` subsequently calls `strlen()` on the NULL argument, terminating the agent process. This is possible when enrollment is permitted against an unverified manager due to the absence of a configured CA certificate. **Recommendations** Update to version 4.14.7.

**Name of the Vulnerable Software and Affected Versions** Wazuh wazuh-modulesd versions prior to 5.0.0-beta3 **Description** A null pointer dereference occurs in the `inventory sync` FlatBuffer DataValue handling. An enrolled agent can trigger a denial of service by sending a verifier-valid DataValue message that omits the optional `id` field. This causes the `wazuh-modulesd` process to crash when it attempts to dereference `data->id()->string view()` without performing null validation. **Recommendations** Update wazuh-modulesd to version 5.0.0-beta3 or later.

**Name of the Vulnerable Software and Affected Versions** rtk versions prior to 0.42.2 **Description** A flaw in the permission splitter logic fails to conservatively split or reject certain Bash shell constructs that create command-execution boundaries or nested execution. This improper input validation and parsing of shell syntax allows a permitted prefix, such as 'git', to mask an additional command. Consequently, the `rtk rewrite` function returns exit code 0, leading the Claude hook to emit a permissionDecision of "allow". This enables the hidden command to execute without the user confirmation or denial intended by the permission rules, potentially leading to unauthorized command execution under the user's context. **Recommendations** Update to version 0.42.2.