Shubham Raj

A flaw exists when the DHCP leasequery feature is enabled without a defined list of allowed source addresses. In this configuration, the server fails to verify the identity of the requester, allowing a host on the local network to retrieve DHCP lease records. This can lead to the exposure of assigned IP addresses, MAC addresses, hostnames, and other lease metadata. This feature is disabled by default.

A flaw in the TFTP server allows it to serve incorrect file contents because the transfer cache is not invalidated upon completion of a transfer. A local network attacker requesting a TFTP file can cause subsequent clients to receive cached data instead of the intended file. In PXE network-boot environments, this allows the substitution of boot content for a victim machine.

The TCP DNS service utilizes a small fixed pool of child processes and fails to implement a receive timeout on client connections. A remote attacker can exhaust this pool by opening idle TCP connections to port 53, which prevents new TCP DNS connections and disrupts DNSSEC validation that relies on TCP fallback. UDP DNS resolution remains functional, and the occupied slots are released after a fixed lifetime.

A flaw exists in the resolver when following a CNAME in a DNS response. The system may cache records for the CNAME target without verifying if those records belong to the authorized zone of the responding server. In split-DNS deployments—where specific domains are routed to a particular upstream server—an attacker controlling that upstream server can inject cache entries for unrelated names, leading clients to receive attacker-controlled addresses.

A flaw exists in the DNSSEC validator where it can write a few bytes past a name buffer during the conversion of names to and from DNS wire format. This occurs due to a reduction in internal domain-name buffer sizes. An attacker can exploit this by causing the server to validate a crafted DNSSEC response, potentially overwriting a small amount of adjacent heap metadata. DNSSEC support must be compiled in and enabled at runtime for this issue to be present.

A flaw exists in the DHCPv6 client hostname parser that allows it to read one byte past the end of a crafted Fully Qualified Domain Name (FQDN) option. This occurs because the parser checks the next label length before confirming the pointer remains within the option boundaries. A local network attacker can trigger this behavior using a single DHCPv6 packet. The extra byte is neither returned to the client nor logged, and no crash has been demonstrated.

Insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

An integer overflow occurs during network request processing, leading to memory allocation with an incorrect size. This flaw allows the handling of attacker-supplied data to cause memory corruption, denial of service, or potential remote code execution.

Improper validation of message length values during protocol parsing can trigger an integer overflow, which leads to an out-of-bounds memory write. This condition may result in process instability or a denial of service.

Insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents.

A flaw exists when the software is built without libc fnmatch. The internal `pmatch()` function implements the asterisk (*) wildcard using unbounded recursion over candidate positions. A local user capable of creating specific filenames or providing input to this matcher can cause excessive CPU consumption by using a short multi-star pattern, such as `*.*.*.*.*.tar.gz`.

A flaw exists in the `printf` builtin where it reserves only four bytes before converting a Unicode `u` or `U` escape sequence. Because multi-byte tokens may require five or six bytes, a local user can write one or two bytes beyond the reserved space. This can be triggered by supplying such an escape to `printf` or `echo %b`, including via `dash -c` and a positional argument.

The `@theia/filesystem` backend binds the 'POST /file-upload' endpoint in every filesystem-enabled deployment. The handler processes an absolute path provided by an attacker via the multipart `uri` field and executes `fs.move(tmp, target, { overwrite: true })` without authentication or workspace confinement. In browser-based deployments, the connection token is only enforced during WebSocket upgrades, while the HTTP middleware in `@theia/core` fails to reject tokenless HTTP requests. Since `multipart/form-data` is a CORS-safelisted request type, a cross-origin web page can trigger an unauthenticated arbitrary file write to any absolute path accessible to the backend process. This can lead to remote code execution, such as by overwriting the `~/.bashrc` file.

The Bulk Variables API fails to pass the variable's key to the redactor. This prevents the `should hide value for key` function from identifying secret-suffixed key names, such as `* password`, `* token`, or `* secret`. Consequently, an authenticated user with bulk Variable read permissions can retrieve plaintext values from JSON-decodable variables that should have been redacted.

The `FTPSHook.get conn()` function in the Apache Airflow FTP provider creates an `ftplib.FTP TLS` connection without calling `prot p()`. This results in the data channel being transmitted in cleartext, even though the control channel is TLS-protected. Consequently, deployments utilizing `FTPSHook` or `FTPSFileTransmitOperator` to transfer files over FTPS expose file contents and credentials-in-transit to network attackers capable of observing the data connection.

The `/ui/dependencies` endpoint in Apache Airflow returns the complete DAG dependency graph without filtering by authorized DAG IDs. This allows an authenticated user with only DAG Dependencies permission to enumerate DAGs they are not authorized to view.

An authorization flaw exists in Apache Airflow that could allow an authenticated user with limited task permissions to view task logs without proper authorization. The issue affects systems where users have custom permissions restricting access to task logs, but still permit task access.

Name of the Vulnerable Software and Affected Versions: Apache Airflow versions prior to 2.10.3 Description: The issue allows authenticated users with audit log access to see sensitive values in audit logs that they should not see. This occurs when sensitive variables are set via the Airflow CLI, resulting in the values being stored unencrypted in the Airflow database. The risk is limited to users with audit log access. Recommendations: For Apache Airflow versions prior to 2.10.3, upgrade to Airflow 2.10.3 or a later version to address this issue. Additionally, users who previously used the CLI to set secret variables should manually delete entries with those variables from the log table.