Martin Brodeur

A flaw exists in the repository-level mirror configuration feature. The POST and PUT handlers in the `endpoints/api/mirror.py` file accept an `external reference` parameter without Server-Side Request Forgery (SSRF) validation. SSRF is a vulnerability that allows an attacker to induce the server-side application to make requests to an unintended location. A repository administrator can provide a crafted hostname, causing the mirror worker to make requests via Skopeo to internal network services, cloud metadata endpoints, or other resources not intended to be reachable from the application.

A missing bounds check in AP-mode Wi-Fi 7 (IEEE 802.11be) Multi-Link Operation (MLO) association request processing allows an unauthenticated attacker within wireless range to send a crafted management frame containing a malformed Multi-Link Element or Per-STA Profile subelement. In the function `hostapd process ml assoc req()`, the `link id` field can be parsed as value 15, while the `links[]` storage only contains valid entries for IDs 0 through 14. This results in an out-of-bounds write and small memory corruption during association processing before the 4-way handshake, leading to a denial of service through process termination. The issue specifically affects systems built with `CONFIG IEEE80211BE` enabled.

A flaw exists in the GitHub webhook integration where the controller stores the `pull request.statuses url` value from a `pull request` webhook payload without validating if it points to a trusted GitHub API endpoint. If a job template uses a GitHub Personal Access Token (PAT) as its webhook credential, the controller sends this token to the stored callback URL during job status updates. An attacker capable of submitting a signed forged webhook using the `webhook key` can redirect the callback to a malicious URL to exfiltrate the GitHub PAT.

A flaw in the fetcher component allows the system to make outbound HTTP requests to attacker-supplied URIs from manifest layer descriptors because it lacks IP or scheme filtering. When Pre-Shared Key (PSK) authentication is not configured, an unauthenticated attacker can submit a manifest with a URI pointing to internal services or cloud metadata endpoints, leading to Server-Side Request Forgery (SSRF). This SSRF is reflective for non-200 responses, which can leak up to 256 bytes of error body content through CheckResponse error messages. Operator-managed Red Hat Quay deployments are not affected as they auto-configure PSK.

A flaw in the GitLab OAuth validator causes sensitive credentials, specifically `client id` and `client secret`, to be transmitted as plaintext in URL query parameters during POST requests to the GitLab endpoint. This insecure transmission can lead to the disclosure of these credentials in server access logs, reverse proxy logs, and other monitoring systems, potentially allowing an attacker with log access to obtain the credentials and achieve unauthorized information disclosure.

A path traversal flaw exists in the chat session handler. A local attacker can manipulate the `logs dir` parameter to create new directories and write files to arbitrary locations on the system, which may result in unauthorized data modification or disclosure. Path traversal is a technique that allows an attacker to access files and directories that are stored outside the web root folder by manipulating variables or parameters that are used to build a file path.