Mayank Jangid

Deactivating a user account does not invalidate tokens issued to that account prior to the deactivation. While password authentication correctly rejects disabled accounts, the Core API continues to accept existing, unexpired tokens and allows them to mint replacements. This enables an account to maintain role-scoped access indefinitely after an administrator has disabled it by replaying legitimate credentials. This issue occurs in deployments using Airflow 3 with the FAB auth manager and Core API token authentication when an account is deactivated but its record remains in the database.

Resetting a user password fails to delete existing database-backed sessions when using the FAB auth manager with `[fab] session backend=database`. This occurs because the cleanup process compares a string identifier stored by Flask-Login in the session against the user's integer database identifier, resulting in a mismatch that prevents session removal. Consequently, an attacker possessing a victim's session cookie maintains access even after a password reset. Additionally, a similar issue exists via the Admin user-edit endpoint.

A crash in the MBIM protocol dissector can lead to a denial of service.

A crash in the Sharkd utility can lead to a denial of service.

A crash in the Frame protocol metadissector allows a denial of service. A metadissector is a component that helps the software determine which dissector should be used to analyze a specific packet.

A large loop in the file parser can be triggered, leading to a denial of service.

A NULL pointer dereference can occur during the decryption of password-encrypted Cryptographic Message Syntax (CMS) messages. The issue arises because the OpenSSL CMS implementation dereferences the `PasswordRecipientInfo.keyDerivationAlgorithm` field without verifying its presence, despite it being defined as optional in the ASN.1 specification. An attacker can exploit this by providing a specially crafted CMS message, causing the application to crash and resulting in a Denial of Service.