Mgerstner

**Name of the Vulnerable Software and Affected Versions** authentik versions prior to 2024.8.5 authentik version 2024.10.3 **Description** The issue is related to the usage of a non-constant time comparison for the "/-/metrics/" endpoint, which made it possible to brute-force the `SECRET KEY` used to authenticate the endpoint. This endpoint returns Prometheus metrics and is not intended to be accessed directly. It is meant to be accessed by the Go proxy running in the authentik server container, which serves the data on a separate port. Since the endpoint is not intended to be accessed publicly, requests to it can be blocked by the reverse proxy/load balancer used with authentik. **Recommendations** For versions prior to 2024.8.5, update to version 2024.8.5 or later to fix the issue. For version 2024.10.3, this version fixes the issue, so no further action is required for this specific version. As a temporary workaround, consider blocking requests to the "/-/metrics/" endpoint by configuring the reverse proxy/load balancer to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Budgie Extras (affected versions not specified) **Description** Temporary data passed between application components by Budgie Extras could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may read private information from windows, present false information to users, or deny access to the application. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Budgie Extras (affected versions not specified) **Description** Temporary data passed between application components by the Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Budgie Extras (affected versions not specified) **Description** Temporary data passed between application components by the Budgie Extras Takeabreak applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Budgie Extras (affected versions not specified) **Description** Temporary data passed between application components by the Budgie Extras WeatherShow applet could potentially be viewed or manipulated. The data is stored in a location that is accessible to any user who has local access to the system. Attackers may pre-create and control this file to present false information to users or deny access to the application and panel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keylime versions prior to 6.3.0 **Description** The issue concerns quote responses from the agent that can contain possibly untrusted ZIP data, leading to zip bombs. **Recommendations** For versions prior to 6.3.0, update to version 6.3.0 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** SWHKD version 1.1.5 **Description** The issue is related to unsafe parsing via the -c option, which can lead to an information leak or a denial of service (memory exhaustion) when attempting to parse large or infinite files, such as block or character devices. **Recommendations** For SWHKD version 1.1.5, consider disabling the use of the -c option until a patch is available to prevent potential memory exhaustion and information leaks. Restrict access to large or infinite files to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SWHKD version 1.1.5 **Description** The issue is related to the unsafe use of the /tmp/swhks.pid pathname, which can lead to data loss or a denial of service. An attacker could exploit this to impact data integrity or cause a service disruption. The vulnerability is associated with the possibility of saving the process ID to the /tmp/swhks.pid file and inserting the ID of an existing process. **Recommendations** For SWHKD version 1.1.5, consider updating to a version where the issue is fixed, as a patch is available on the 1.1.0 branch of the repository. As a temporary workaround, consider restricting access to the /tmp/swhks.pid file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SWHKD versions 1.1.5 and prior **Description** The issue is related to the use of the /tmp/swhkd.pid pathname by the SWHKD daemon, which can lead to information leaks or denial of service. This is because the /tmp directory is accessible to all users. The exploitation of this issue may allow a remote attacker to access protected information or cause a denial of service. **Recommendations** For SWHKD versions 1.1.5 and prior, consider updating to a version where this issue is fixed, such as a version from the `1.1.0` branch of the repository, where a patch is available. As a temporary workaround, consider restricting access to the /tmp/swhkd.pid file to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** SWHKD version 1.1.5 **Description** The issue is related to the unsafe use of the `/tmp/swhkd.sock` pathname by SWHKD, which can lead to an information leak or denial of service. This could potentially allow a remote attacker to access protected information or cause a service disruption. **Recommendations** For SWHKD version 1.1.5, consider restricting access to the `/tmp/swhkd.sock` socket file as a temporary mitigation measure until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Cinnamon versions 1.9.2 through 3.8.6 **Description** An issue was discovered where the cinnamon-settings-users.py GUI, running as root, allows configuration of other users' icon files. This can lead to arbitrary file overwrites if an unprivileged user prepares a symlink to a target location. The icon files are written to the respective user's $HOME/.face location. **Recommendations** For Cinnamon versions 1.9.2 through 3.8.6, consider restricting access to the cinnamon-settings-users.py GUI to prevent unprivileged users from preparing symlinks that could lead to arbitrary file overwrites. As a temporary workaround, consider disabling the on face browse menuitem activated and on face menuitem activated functions until a patch is available.

**Name of the Vulnerable Software and Affected Versions** tcmu-runner versions 1.0.5 through 1.2.0 **Description** The issue concerns a local denial of service attack. **Recommendations** For versions 1.0.5 through 1.2.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** tcmu-runner versions 1.0.5 through 1.2.0 **Description** The issue is related to a dbus triggered NULL pointer dereference in the `on unregister handler()` function of the tcmu-runner daemon, resulting in denial of service. **Recommendations** For versions 1.0.5 through 1.2.0, as a temporary workaround, consider disabling the `on unregister handler()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** tcmu-runner versions 0.91 through 1.20 **Description** The issue allows non-privileged users to check for the existence of any file with root privileges due to information disclosure in handler qcow.so. **Recommendations** For versions 0.91 through 1.20, update to a version that contains a fix for this issue to prevent information disclosure.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 6.9.7-6 ImageMagick versions 7.x prior to 7.0.4-6 **Description** The issue is related to the ReadMATImage function in coders/mat.c, which uses uninitialized data. This could potentially allow remote attackers to obtain sensitive information from process memory. **Recommendations** For ImageMagick versions prior to 6.9.7-6, update to version 6.9.7-6 or later. For ImageMagick versions 7.x prior to 7.0.4-6, update to version 7.0.4-6 or later.