Todd Cullum

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting (XSS) vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute arbitrary JavaScript code. This allows the attacker to perform actions within the victim's authenticated session, potentially leading to full administrative control if an IdM administrator is targeted.

**Name of the Vulnerable Software and Affected Versions** BlueChi (affected versions not specified) **Description** BlueChi, a multi-node systemd service controller used in RHIVOS, contains a flaw involving unrestricted cross-node systemd dependencies. This allows a user with root privileges on a managed node (qm) to create or override systemd service unit files that affect the host node, potentially leading to privilege escalation, unauthorized service execution, and system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A vulnerability was found in Keycloak where expired OTP codes are still usable when using FreeOTP with the default OTP token period of 30 seconds. Instead of expiring after 30 seconds, the tokens remain valid for an additional 30 seconds, totaling 1 minute. This increases the attack window for malicious actors to abuse the system and compromise accounts, as well as the attack surface, since two OTPs are valid at any given time. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An open redirect issue exists in Keycloak, where a specially crafted URL can be constructed to trick users into visiting a malicious webpage. The `referrer` and `referrer uri` parameters can be manipulated to make a trusted URL appear safe, when in fact it redirects to a malicious server. This can lead to successful phishing attacks or other types of attacks. A malicious actor can send a crafted URL to a Keycloak admin via email, triggering the vulnerability when the user visits the page and clicks the link. The malicious actor can also obfuscate the `redirect uri` using URL encoding to hide the text of the actual malicious website domain. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** convert2rhel (affected versions not specified) **Description** The issue is related to the use of the --activationkey option with convert2rhel, which passes the activation key to subscription-manager via the command line. This could allow unauthorized users locally on the machine to view the activation key via the process command line, using tools like htop or ps. The impact varies depending on the subscription, but it could enable an attacker to register systems purchased by the victim until discovered, resulting in a form of fraud. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ImageMagick versions prior to 7.1.0-30 **Description** A crafted file could trigger an assertion failure in ImageMagick when a call to WriteImages was made, potentially causing a denial of service due to a NULL image list. **Recommendations** For versions prior to 7.1.0-30, update to version 7.1.0-30 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** convert2rhel (affected versions not specified) **Description** The issue concerns an ansible playbook named ansible/run-convert2rhel.yml in convert2rhel, which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. It is noted that this ansible playbook is only an example in the upstream repository and is not shipped in officially supported versions of convert2rhel. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** pki-core (affected versions not specified) **Description** A flaw was found in pki-core, allowing a user to obtain a certificate for another user identity when directory-based authentication is enabled. This issue enables an authenticated attacker on the adjacent network to impersonate another user within the domain scope, although they cannot decrypt message content. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libtiff (affected versions not specified) **Description** The issue is related to a uint32 t underflow in libtiff's tiffcrop utility, which can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop could cause a crash or potentially further exploitation. This can be achieved by tricking a user into running tiffcrop on the crafted file with specific parameters. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libtiff versions (affected versions not specified) **Description** The issue is related to a uint32 t underflow in the tiffcrop tool of the libtiff library, leading to out of bounds read and write in the `extractContigSamples8bits` routine. An attacker could trigger this flaw by supplying a crafted file to tiffcrop, potentially causing a crash or further exploitation. This could be achieved by tricking a user into opening the crafted file with tiffcrop. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libtiff versions (affected versions not specified) **Description** The issue is related to an improper input validation flaw in libtiff's tiffcrop utility. This flaw can lead to an out of bounds read, causing a crash if an attacker supplies a crafted file to tiffcrop. There is no information provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** KeePass (affected versions not specified) **Description** A flaw in KeePass leads to an Information Exposure issue due to the logging of plain text passwords in the system log. This allows an attacker to interact with and read sensitive passwords and logs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** RPM (affected versions not specified) **Description** The issue is related to a flaw in RPM's signature functionality, where OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. This could allow an attacker to add a malicious subkey to a legitimate public key, causing RPM to wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libdnf versions prior to 0.60.1 **Description** The issue is related to an error in the signature verification function of the libdnf library, which manages packages. This could allow a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The flaw enables an attacker to achieve code execution by altering the header information of an RPM package and tricking a user or system into installing it, posing a risk to confidentiality, integrity, and system availability. **Recommendations** For versions prior to 0.60.1, update to version 0.60.1 or later to resolve the issue. As a temporary workaround, consider restricting the installation of RPM packages from untrusted sources to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: m2crypto versions prior to the fixed version Description: A flaw was found in m2crypto, where it is vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality. This issue is related to the Bleichenbacher attack, which was first discovered in 1998 and has been revisited in recent research, showing that many software implementations of the PKCS #1 v1.5 scheme for RSA key exchange are vulnerable. The attack allows an attacker to decrypt messages and forge signatures by measuring the time it takes for a server to process specially crafted encrypted texts. Recommendations: For m2crypto, consider disabling the use of PKCS#1 v1.5 for RSA key exchange until a patch is available. Restrict access to the RSA decryption API to minimize the risk of exploitation. As a temporary workaround, avoid using the `DecryptPKCS1v15SessionKey` function in the crypto/rsa API until the issue is resolved. It is recommended to stop using RSA PKCS#1 v1.5 encryption. At the moment, there is no information about a newer version that contains a fix for this vulnerability.