Qi Deng

Handshake messages, such as KeyUpdate, are treated as state-advancing regardless of whether a handshake has been completed. This allows a malicious client to continuously send KeyUpdate messages, forcing the server to perform key derivation operations indefinitely.

A Use of Less Trusted Source issue exists where an attacker can leverage the `wolf-rbac` plugin under default configuration. This allows for the potential pollution of logs with spoofed identity information and the exploitation of IP-based access control rules.

An Open Redirect issue exists in the default configuration of the `cas-auth` plugin, where unsanitized cookie values can lead to URL redirection to untrusted sites. This flaw can be leveraged for phishing and credential theft.

The openid-connect plugin under default configuration contains an issue where insufficient verification of data authenticity allows an attacker to spoof identity headers. This can lead to unauthorized access to protected resources.

An improper access check allows unauthorized access to `com config` webservice endpoints.

The `ftpcp()` function in Lib/ftplib.py fails to use the actual peer address, instead trusting the host address supplied by the server during a PASV command. This occurs because `ftpcp()` calls `parse227()` directly and passes the raw, attacker-controllable IP address and port to `target.sendport()`, leading to a Server-Side Request Forgery (SSRF), where a server is tricked into making unintended requests to internal or external resources.

Workspace dotenv files can be used to override connector endpoint hosts for Matrix, Mattermost, IRC, and Synology connectors. This allows attackers with workspace access to redirect runtime traffic to malicious endpoints by configuring endpoint variables within these files.

The software contains a sandbox boundary bypass issue in the fs-bridge writeFile commit step. This is due to the use of an unanchored container path during the final move operation, creating a time-of-check-time-of-use race condition. An attacker can modify parent paths within the sandbox to redirect committed files outside the validated writable path within the container mount namespace.

The software contains an improper network binding issue in the Chrome extension relay server. The server incorrectly handles wildcard hosts, treating them as loopback addresses. This allows the relay HTTP/WS server to bind to all interfaces when a wildcard `cdpUrl` is configured. Remote attackers can potentially access relay HTTP endpoints from outside the intended network, which could expose service presence and port information. This could also enable denial-of-service and brute-force attacks against the relay token header. The vulnerable component is the Chrome extension relay server, specifically the `ensureChromeExtensionRelayServer` function. The `cdpUrl` variable is a key factor in triggering this issue.

Name of the Vulnerable Software and Affected Versions: Windows Application Compatibility Client Library (affected versions not specified) Description: The issue is related to the improper handling of registry operations by the Windows Application Compatibility Client Library, which could allow an attacker to gain elevated privileges. To exploit this, an attacker would first need code execution on a victim system and then run a specially crafted application. The security update addresses the vulnerability by ensuring the library properly handles registry operations. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.