Abergmann

**Name of the Vulnerable Software and Affected Versions** radare2 versions prior to 5.9.9 **Description** The issue is an Out-of-bounds Write vulnerability that allows heap-based buffer over-read or buffer overflow. This can lead to a buffer overflow, which is a type of attack where more data is written to a buffer than it is designed to hold, potentially causing the program to crash or allowing an attacker to execute arbitrary code. **Recommendations** For versions prior to 5.9.9, update to version 5.9.9 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable components of radare2 until a patch is applied.

**Name of the Vulnerable Software and Affected Versions** radare2 versions prior to 5.8.6 **Description** The issue is a Denial of Service in the GitHub repository radareorg/radare2. **Recommendations** For versions prior to 5.8.6, update to version 5.8.6 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** github.com/thecodingmachine/gotenberg (affected versions not specified) **Description** The issue allows for Server-side Request Forgery (SSRF) via the "/convert/html" endpoint. This occurs when the `src` attribute of an HTML element, such as an `iframe`, refers to an internal system file, for example, `<iframe src='file:///etc/passwd'>`. **Recommendations** As a temporary workaround, consider disabling the "/convert/html" endpoint until a patch is available. Restrict access to internal system files to minimize the risk of exploitation. Avoid using the `src` attribute in HTML elements within the "/convert/html" endpoint to refer to internal system files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Laravel versions prior to 8.4.2 Ignition versions prior to 2.5.2 **Description** The issue is related to insecure usage of `file get contents()` and `file put contents()` in the Ignition library used by Laravel. This allows unauthenticated remote attackers to execute arbitrary code when debug mode is enabled. The vulnerability is exploitable on sites using Laravel before version 8.4.2. It has been reported that this issue is being actively exploited, with attackers targeting cloud-hosted large language model services by leveraging stolen cloud credentials. **Recommendations** For Laravel versions prior to 8.4.2, update to version 8.4.2 or later to resolve the issue. For Ignition versions prior to 2.5.2, update to version 2.5.2 or later to resolve the issue. As a temporary workaround, consider disabling debug mode in Laravel until a patch is applied. Restrict access to the Ignition module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Gobby version 0.4.11 **Description** The issue allows a NULL pointer dereference in the D-Bus handler for certain `set language` calls. **Recommendations** For version 0.4.11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Envoy versions prior to 1.16.1 **Description** The issue arises when Envoy logs an incorrect downstream address, considering only the directly connected peer and not the information in the proxy protocol header. This specifically affects situations where tcp-proxy is used as the network filter, excluding HTTP filters. **Recommendations** For versions prior to 1.16.1, update to version 1.16.1 or later to resolve the issue. As a temporary workaround, consider configuring the logging mechanism to account for the proxy protocol header information until a patch is applied. Restrict access to the tcp-proxy network filter to minimize the risk of incorrect logging.

**Name of the Vulnerable Software and Affected Versions** Gitea versions 0.9.99 through 1.12.x before 1.12.6 **Description** The issue arises from the failure to prevent a git protocol path that specifies a TCP port number and also contains newlines (with URL encoding) in `ParseRemoteAddr` in `modules/auth/repo form.go`. This allows for potential exploitation. **Recommendations** For Gitea versions 0.9.99 through 1.12.x before 1.12.6, update to version 1.12.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the `ParseRemoteAddr` function in `modules/auth/repo form.go` until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Rsyslog version 8.1908.0 **Description** The issue is related to out-of-bounds access in the contrib/pmdb2diag/pmdb2diag.c file due to mishandling of the level length. **Recommendations** For Rsyslog version 8.1908.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Python (CPython) version 2.7 **Description** The issue is related to a command injection vulnerability in the `shutil` module, specifically in the `make archive` function. This vulnerability can be exploited by passing unfiltered user input to the function, potentially resulting in denial of service or information gain via injection of arbitrary files on the system or entire drive. The vulnerability appears to be exploitable via the passage of unfiltered user input to the function. **Recommendations** For Python (CPython) version 2.7, consider updating to a version where the issue has been fixed, as indicated by the commit add531a1e55b0a739b0f42582f1c9747e5649ace. As a temporary workaround, consider filtering user input before passing it to the `make archive` function in the `shutil` module to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Docker Moby versions prior to 17.06.0 **Description** An issue was discovered where the Docker engine validated a client TLS certificate using both the configured client CA root certificate and all system roots on non-Windows systems. This allowed a client with any domain validated certificate signed by a system-trusted root CA to authenticate. **Recommendations** For versions prior to 17.06.0, update to version 17.06.0 or later to resolve the issue.