Bzimport

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in the Fine-Grained Admin Permissions (FGAP) v2 implementation within the administrative services. When FGAP v2 is enabled, the system does not correctly filter child groups based on the caller's permissions when accessed via a parent group. This allows a delegated administrator to bypass permission filters and view details of child groups they are not authorized to access, including group names, paths, and custom attributes. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Foreman (affected versions not specified) **Description** A flaw in the `http proxies controller` and `http proxy` files allows attackers to perform a Server-Side Request Forgery (SSRF) attack. SSRF is a technique where an attacker induces a server-side application to make requests to an unintended location. This issue can be exploited by modifying HTTP parameters to steal cloud metadata service information within AWS, GCP, or Azure environments. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** p11-kit (affected versions not specified) **Description** A flaw exists in the RPC message attribute parsing process. The functions `p11 rpc message get attribute()` and `p11 rpc message get attribute array value()` create a mutually-recursive call chain that lacks a recursion depth limit when handling nested `CKA WRAP TEMPLATE`, `CKA UNWRAP TEMPLATE`, and `CKA DERIVE TEMPLATE` attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can trigger stack exhaustion—a condition where the program's call stack overflows—by sending a specially crafted request with deeply nested template attributes, resulting in the crash of the p11-kit server process and its dependent services. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Apicurio Registry (affected versions not specified) **Description** A flaw exists where the `WSDLReaderAccessor` creates a wsdl4j `WSDLReader` without disabling the `javax.wsdl.importDocuments` feature. When the `VALIDITY` rule is set to FULL, a user with Developer-role access can upload a WSDL document containing malicious import locations. This leads to Server-Side Request Forgery (SSRF), a condition where the server is coerced into making unauthorized HTTP requests to arbitrary internal URLs. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak Policy Enforcer (affected versions not specified) **Description** An issue exists that allows authenticated users to bypass authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. An attacker can gain unauthorized access to protected resources by including the configured access-denied page path within a request URL, either as a path segment or a query parameter. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw exists in the netfilter component of the Linux kernel, specifically within the Network Address Translation (NAT) subsystem. The issue stems from improper memory management when releasing network filter operation structures. This can lead to a system crash resulting in a Denial of Service (DoS) or the unauthorized exposure of sensitive internal hook data during error handling. The problem is particularly relevant when dumping active netfilter hooks from userspace, as the `nf nat register fn()` function may partially expose hooks during the error path. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw exists in the handling of Generic Segmentation Offload (GSO) packet headers. The `qdisc pkt len segs init()` function fails to properly pull headers into the expected memory location, which can lead to incorrect processing by network drivers. This is particularly risky for `net/core/tso.c` users because `tso build hdr()` performs a `memcpy(hdr, skb->data, hdr len)`. A remote attacker could exploit this by sending specially crafted malicious packets, potentially causing a denial of service (DoS) or other unexpected system behavior. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** abrt-dbus (affected versions not specified) **Description** A race condition exists in the `ChownProblemDir` method of the abrt-dbus D-Bus service. The `ChownProblemDir` method opens the dump directory using `DD OPEN READONLY` and executes `dd chown()` to change the ownership of all files to the user ID of the caller. This process can succeed even when post-create event handlers maintain a write lock, enabling an attacker to obtain filesystem-level control of the dump directory while privileged event scripts are still active. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenEXR versions 3.4.0 through 3.4.11 **Description** The HTJ2K (High-Throughput JPEG 2000) decoder in OpenEXRCore contains a heap-buffer-overflow READ in the `ht undo impl()` function. This occurs because the function copies decoded pixels from a per-line OpenJPH buffer using the EXR channel's declared width as the iteration count without validating if the codestream embedded in the EXR chunk has smaller tile or line dimensions than those advertised in the EXR header. Consequently, the function reads 32-bit samples from `cur line->i32[]` beyond the actual length of the OpenJPH line buffer. A specially crafted EXR file can trigger a 4-byte heap-buffer-overflow READ following a buffer allocated by `ojph::local::codestream::finalize alloc()`. This issue is reachable via the standard scanline-decode entry point used by any application opening untrusted EXR files, such as thumbnailers, asset pipelines, and the exrcheck utility, leading to a deterministic crash (Denial of Service) and potential adjacent-heap leak. **Recommendations** Update to version 3.4.12.

**Name of the Vulnerable Software and Affected Versions** mlflow versions prior to 3.11.0 **Description** An issue allows for the resolution of environment variables in AI Gateway secrets, enabling the exfiltration of sensitive server-side environment credentials to an attacker-controlled endpoint. This occurs because the `api key` field in gateway secrets accepts `$ENV VAR` references, which the MLflow server resolves during runtime and sends in provider authentication headers to the configured upstream `api base`. The flaw can be exploited by unauthenticated users in default deployments or low-privileged authenticated users in basic-auth deployments. Potential impacts include the leakage of cloud artifact credentials such as `AWS ACCESS KEY ID` and `AWS SECRET ACCESS KEY`, which may lead to artifact poisoning and cross-boundary code execution in downstream environments. **Recommendations** Update to version 3.11.0.

**Name of the Vulnerable Software and Affected Versions** ACM/MCE assisted-service (affected versions not specified) **Description** The assisted-service writes raw referenced pull-secret contents into the `InfraEnv.status.conditions[].message` field when pull-secret validation fails. This allows a namespace principal with the `view` ClusterRole to recover `.dockerconfigjson` data, including `username`, `password`, `email`, and base64 `auth` fields, by reading `InfraEnv` objects. This behavior bypasses the Kubernetes/OpenShift Role-Based Access Control (RBAC) separation between read-only namespace viewers and Secret readers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A Use-After-Free (UAF) issue exists in the rxrpc component. If the `skb unshare()` function fails to unshare a packet due to an allocation failure within `rxrpc input packet()`, the skb pointer in the parent function `rxrpc io thread()` is set to NULL. This sequence leads to a system oops when `trace rxrpc rx done()` is called. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** FFmpeg versions prior to 8.1.2 **Description** A heap out-of-bounds write flaw, dubbed PixelSmash, exists in the `libavcodec` library, specifically within the MagicYUV decoder. The issue stems from a rounding mismatch in the slice handling code where improper validation of the `slice height` variable allows an attacker to manipulate buffer memory. By providing a specially crafted media file in AVI, MKV, or MOV format (as small as 50 KB), a remote attacker can cause a denial-of-service or execute arbitrary code. Technical exploitation involves overflowing the chroma plane buffer to overwrite the `AVBuffer` structure, which contains a function pointer. By replacing this pointer with the address of the `system()` function and providing a shell command, the attacker can achieve remote code execution during normal frame cleanup when `av frame unref()` is called. This can be triggered without user interaction (zero-click) through automatic media library scanning, metadata extraction, or thumbnail generation in applications such as Jellyfin, Nextcloud, Kodi, Emby, Immich, and OBS Studio. The vulnerability is considered a supply chain risk due to the widespread integration of `libavcodec` across various media servers, cloud platforms, and IoT devices. **Recommendations** Update FFmpeg to version 8.1.2 or later. As a temporary mitigation, disable the MagicYUV decoder or restrict the processing of untrusted media files.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An access control flaw exists in the OpenID Connect (OIDC) token introspection endpoint. This issue allows a confidential client with valid credentials to bypass audience restrictions and retrieve sensitive token claims intended for other resource servers, which compromises the confidentiality of lightweight access tokens. The flaw can be exploited remotely by any confidential client within the realm. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Traefik versions prior to 2.11.46 Traefik versions prior to 3.6.17 Traefik versions prior to 3.7.1 **Description** Traefik's Kubernetes Gateway API provider contains an authorization bypass that allows a tenant with `HTTPRoute` creation permissions to expose the REST provider handler. This occurs because the Gateway provider accepts any `TraefikService` backend reference ending with `@internal`, enabling traffic to be routed to `rest@internal` instead of only the intended `api@internal`. In shared Gateway deployments where the REST provider is enabled, a low-privileged actor can bypass the `providers.rest.insecure=false` setting to gain live dynamic configuration write access via the 'PUT /api/providers/rest' endpoint. This access allows for the unauthorized reconfiguration of routers and services. **Recommendations** Update to version 2.11.46. Update to version 3.6.17. Update to version 3.7.1.

**Name of the Vulnerable Software and Affected Versions** BIND 9 versions 9.11.0 through 9.16.50 BIND 9 versions 9.18.0 through 9.18.48 BIND 9 versions 9.20.0 through 9.20.22 BIND 9 versions 9.21.0 through 9.21.21 BIND 9 versions 9.11.3-S1 through 9.16.50-S1 BIND 9 versions 9.18.11-S1 through 9.18.48-S1 BIND 9 versions 9.20.9-S1 through 9.20.22-S1 **Description** Multiple flaws exist in `named` regarding the handling of DNS messages where the CLASS is not Internet (`IN`), such as `CHAOS` or `HESIOD`, or messages specifying meta-classes like `ANY` or `NONE` in the question section. Specially crafted requests targeting code paths related to recursion, dynamic updates (`UPDATE`), zone change notifications (`NOTIFY`), or the processing of `IN`-specific record types in non-`IN` data can trigger assertion failures in `named`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** dovecot versions prior to 2.4.4-1.1 **Description** An attacker can cause uncontrolled memory usage via excessive bracing over IMAP. A previous fix was incomplete as it only blocked closing braces, allowing the memory limit to be bypassed using open braces. This can lead to memory consumption reaching the configured limit. **Recommendations** Update to version 2.4.4-1.1. Configure `vsz limit` for the imap process to a low value.

**Name of the Vulnerable Software and Affected Versions** python-multipart versions prior to 0.0.27 **Description** A denial of service issue exists in the multipart part header parsing of the `MultipartParser` when processing `multipart/form-data`. The parser lacked limits on the number of part headers and the size of individual part headers. An attacker could cause excessive CPU work, leading to CPU exhaustion and potential worker or event-loop delays in ASGI applications using frameworks like Starlette or FastAPI, by sending a request with a single very large header value or many repeated headers without terminating the header block. The affected parser states include `HEADER FIELD START`, `HEADER FIELD`, `HEADER VALUE START`, `HEADER VALUE`, and `HEADER VALUE ALMOST DONE`. **Recommendations** Update to version 0.0.27 or later. Enforce request body size limits at the server, proxy, or framework layer to reduce exposure.

**Name of the Vulnerable Software and Affected Versions** gnutls versions prior to 3.8.13-1.1 **Description** A flaw exists where permitted name constraints are incorrectly ignored when previous Certificate Authorities (CAs) only have excluded name constraints. A remote attacker can exploit this to bypass critical name constraint checks during certificate validation, which may lead to the acceptance of invalid certificates and enable spoofing or man-in-the-middle attacks. **Recommendations** Update to version 3.8.13-1.1.

**Name of the Vulnerable Software and Affected Versions** Apache HTTP Server versions 2.4.0 through 2.4.67 **Description** A buffer over-read occurs during outbound OCSP (Online Certificate Status Protocol) requests sent to an attacker-controlled OCSP server. A buffer over-read is a condition where a system reads data past the end of the intended buffer, potentially exposing sensitive information from memory. **Recommendations** Upgrade to version 2.4.68.