Snoopysecurity

**Name of the Vulnerable Software and Affected Versions** Deno versions prior to 2.7.5 **Description** A Deno program opening a client WebSocket connection can be crashed by a remote server. During the WebSocket handshake response, Deno parsed the 'Sec-WebSocket-Protocol' and 'Sec-WebSocket-Extensions' response headers assuming the bytes were printable ASCII. If a response header contains non-visible-ASCII bytes (`0x80`-`0xFF`), it triggers a panic in the `HeaderValue::to str()` function, which aborts the entire Deno process. This results in a remote denial of service where an attacker controlling the WebSocket endpoint or performing a man-in-the-middle attack on a plaintext 'ws://' connection can terminate the process that initiated the outbound connection. **Recommendations** Update to version 2.7.5 or later. As a temporary workaround, only connect to trusted WebSocket endpoints and prefer 'wss://' (TLS) over 'ws://' to prevent network man-in-the-middle injection of malicious header bytes.

**Name of the Vulnerable Software and Affected Versions** CarrierWave versions prior to 2.2.7 CarrierWave versions prior to 3.1.3 **Description** CarrierWave is a framework used to upload files from Ruby applications. The `content type denylist` check fails to escape regex metacharacters in string entries, causing the denylist to silently fail when matching the content types it is intended to block. In the `denylisted content type()` function, denylist entries are interpolated directly into a regular expression without using `Regexp.quote` or anchoring. For example, an entry like `image/svg+xml` is treated as a pattern where the `+` character is interpreted as a quantifier rather than a literal character, preventing it from matching the actual MIME type. Other content types containing regex metacharacters, such as `application/xhtml+xml`, are similarly affected. This allows an attacker to upload files, such as SVG files containing arbitrary JavaScript, which can lead to stored Cross-Site Scripting (XSS) if the application serves the file inline from its own origin. **Recommendations** Update to version 2.2.7 for users on the 2.x branch. Update to version 3.1.3 for users on the 3.x branch. As a temporary workaround, restrict the use of the `content type denylist` feature until the software is updated.

**Name of the Vulnerable Software and Affected Versions** lxc versions prior to 7.0.0 **Description** A logic flaw in the `find line()` function of the `lxc-user-nic` setuid helper allows an unprivileged user to delete OVS-attached network interfaces belonging to other users. When scanning the NIC database to authorize a deletion request, the interface name comparison may set the authorization flag based solely on a name match, ignoring ownership, type, and link fields. This occurs because the check is reachable after the `goto next` label handling, and subsequent processes do not re-verify that the matched entry belongs to the caller. In multi-tenant environments using OpenVSwitch bridges, an attacker with a valid `lxc-usernet` policy entry can trigger the deletion of another user's OVS port on the same bridge, resulting in a denial of service by repeatedly disconnecting networking from other tenants' containers. **Recommendations** Update to version 7.0.0.

Name of the Vulnerable Software and Affected Versions: hackney versions 0.0.0 and later Description: The issue arises from improper parsing of URLs by the URI built-in module and hackney, leading to Server-side Request Forgery (SSRF). Given a URL like http://127.0.0.1?@127.2.2.2/, the URI function correctly identifies the host as 127.0.0.1, but hackney incorrectly refers to the host as 127.2.2.2/. This can be exploited when users rely on the URL function for host checking. Recommendations: For hackney versions 0.0.0 and later, consider disabling the URL parsing functionality until a patch is available. Restrict access to the vulnerable module to minimize the risk of exploitation. Avoid using the `URI` module for host checking in the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory. This can lead to unintended file modifications. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is caused by improper path sanitization, allowing archives with relative file paths to write or overwrite files outside the intended directory. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.