Alchemist

**Name of the Vulnerable Software and Affected Versions** Ghostscript versions prior to 10.03.1 **Description** A format string injection flaw exists in the uniprint device of Ghostscript, a PostScript and PDF interpreter. The issue occurs because the device allows users to pass string fragments as options—specifically `upWriteComponentCommands` and `upYMoveCommand`—which are then processed as format strings by the `gp fprintf()` and `gs snprintf()` functions without proper restriction. This allows an attacker to inject arbitrary format specifiers (such as `%n`, `%s`, and `%x`), leading to memory corruption, data leakage from the stack, and a bypass of the SAFER sandbox. The SAFER sandbox is a security mechanism designed to prevent PostScript code from executing dangerous commands or accessing arbitrary files. Successful exploitation can result in a denial of service or the execution of arbitrary code within the context of the Ghostscript process, potentially leading to full system compromise if the software is running with elevated privileges. **Recommendations** Upgrade to version 10.03.1 or later. As a temporary mitigation, disable Ghostscript delegates and restrict the processing of PDF and PS files. Isolate servers used for document processing to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** mailcow versions prior to 2024-04 **Description** A security issue has been identified in the exception handling mechanism of mailcow, specifically when not operating in DEV MODE. The system saves exception details into a session array without proper sanitization or encoding, which are later rendered into HTML and executed in a JavaScript block within the user's browser without adequate escaping of HTML entities. This allows for Cross-Site Scripting (XSS) attacks, where attackers can inject malicious scripts into the admin panel by triggering exceptions with controlled input, potentially leading to session hijacking and unauthorized administrative actions. **Recommendations** For versions prior to 2024-04, update to version 2024-04 to resolve the issue. As a temporary workaround, consider restricting access to functions that might throw exceptions with user-controllable arguments until the update is applied.

Name of the Vulnerable Software and Affected Versions: mailcow:dockerized versions prior to 2024-04 Description: The issue is related to the `rspamd maps()` function and involves improper path validation, allowing for path traversal and arbitrary code execution. This can enable an authenticated admin user to overwrite any file writable by the www-data user, potentially leading to the execution of arbitrary commands on the server. Recommendations: For versions prior to 2024-04, update to version 2024-04 or later, which contains a patch for the issue. As a temporary workaround, consider restricting access to the `rspamd maps()` function to minimize the risk of exploitation. Additionally, ensure that proper access controls and permissions are in place for the www-data user to prevent unauthorized file overwrites.

**Name of the Vulnerable Software and Affected Versions:** Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier. **Description:** Jenkins is vulnerable to an arbitrary file read vulnerability through its command line interface (CLI). This flaw stems from the args4j library's expandAtFiles feature, which is enabled by default. An unauthenticated attacker can exploit this vulnerability to read arbitrary files on the Jenkins controller file system. In some cases, this can lead to the exposure of sensitive information, including cryptographic keys, potentially enabling remote code execution. Multiple proof-of-concept (PoC) exploits have been released and are actively being exploited in the wild, with reports of ransomware attacks leveraging this vulnerability. CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to address it by September 9, 2024. The vulnerability allows attackers to read files without authentication, and in some cases, read the first few lines of files even without overall read permissions. **Recommendations:** Jenkins versions 2.441 and earlier, including LTS 2.426.2 and earlier, are vulnerable. Upgrade to version 2.442 or LTS 2.426.3 or later to address this vulnerability. If upgrading is not immediately possible, disable access to the Jenkins CLI.