Mjkim610

**Name of the Vulnerable Software and Affected Versions** Pi-hole Core versions 6.0 through 6.4.1 Pi-hole FTL versions 6.0 through 6.6.0 **Description** Two shell scripts, `pihole-FTL-prestart.sh` and `pihole-FTL-poststop.sh`, executed as root by systemd, read the `files.pid` path from the configuration without validation and use it in privileged file operations. An attacker with pihole privileges can write an arbitrary path into `files.pid` to cause the root user to delete and recreate any file on the system outside the ProtectSystem=full-restricted directories, granting write access to those files. On default installations, this allows local privilege escalation to root through the manipulation of SSH authorized keys. **Recommendations** Update Core to version 6.4.2. Update FTL to version 6.6.1.

**Name of the Vulnerable Software and Affected Versions** Netty versions prior to 4.1.133.Final Netty versions prior to 4.2.13.Final **Description** Request-line validation can be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created and its URI is subsequently modified using the `setUri()` function. While constructors reject CRLF (Carriage Return Line Feed) and whitespace characters to prevent start-line corruption, `setUri()` does not perform this validation. Consequently, `HttpRequestEncoder` and `RtspEncoder` write the URI into the request line verbatim. If attacker-controlled input is passed to `setUri()`, it enables CRLF injection and the insertion of additional HTTP or RTSP requests. This can lead to HTTP request smuggling, desynchronization on the HTTP side, and request injection on the RTSP side. **Recommendations** Update to version 4.1.133.Final or later. Update to version 4.2.13.Final or later. As a temporary workaround, avoid using the `setUri()` function with attacker-controlled input.