Patrick Uiterwijk

Name of the Vulnerable Software and Affected Versions: keylime versions 5.8.1 and older Description: A flaw was found in the Keylime agent and registrar code, which invalidates the cryptographic chain of trust from the Endorsement Key certificate to agent attestations. Recommendations: For keylime versions 5.8.1 and older, update to a version newer than 5.8.1 to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ipsilon versions 1.0 through 1.0.2 ipsilon versions 1.1 through 1.1.1 ipsilon versions 1.2 through 1.2.0 ipsilon versions 2.0 through 2.0.1 **Description** A issue was found that allows an attacker to log out active sessions of other users. This is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also referred to as a "SAML2 multi-session" issue. **Recommendations** For ipsilon versions 1.0 through 1.0.2, update to version 1.0.3 or later. For ipsilon versions 1.1 through 1.1.1, update to version 1.1.2 or later. For ipsilon versions 1.2 through 1.2.0, update to version 1.2.1 or later. For ipsilon versions 2.0 through 2.0.1, update to version 2.0.2 or later.

**Name of the Vulnerable Software and Affected Versions** TGCaptcha2 version 0.3.0 **Description** The issue is related to a missing nonce, which enables attackers to reuse a single solved CAPTCHA multiple times, effectively bypassing the CAPTCHA's security mechanism. **Recommendations** For TGCaptcha2 version 0.3.0, consider implementing a nonce to prevent replay attacks until a patch is available. As a temporary workaround, restrict the use of the CAPTCHA mechanism to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Ipsilon versions 0.1.0 through 1.0.0 **Description** The issue is related to the Identity Provider (IdP) server, where the `providers/saml2/admin.py` file does not properly check permissions to update the SAML2 Service Provider (SP) owner. This allows remote authenticated users to cause a denial of service via a duplicate SP name. **Recommendations** For Ipsilon versions 0.1.0 through 1.0.0, update to version 1.0.1 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Ipsilon versions 0.1.0 through 1.0.1 Ipsilon versions 1.1.x prior to 1.1.1 **Description** The issue is related to improper permission checking in the `providers/saml2/admin.py` file of the Identity Provider (IdP) server. This allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP). **Recommendations** For Ipsilon versions 0.1.0 through 1.0.1, update to version 1.0.2 or later. For Ipsilon versions 1.1.x prior to 1.1.1, update to version 1.1.1 or later.