Kamil-Sawicki

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** An HMAC ambiguity in Gitea Actions Artifacts V4 signed URLs allows for cross-repository artifact reading and cross-task upload-state writing. HMAC (Hash-based Message Authentication Code) is a mechanism for verifying both the data integrity and the authenticity of a message. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** ProxySQL versions 3.0.0 through 3.0.8 **Description** The GenAI/MCP `run sql readonly` tool violates its read-only contract for MySQL targets. The tool validates input using a substring blacklist and a first-keyword allowlist, but executes the SQL string on a backend connection created with `CLIENT MULTI STATEMENTS`. This allows a caller to bypass restrictions by submitting a read-only first statement followed by a side-effecting second statement, such as `SELECT 1; RENAME TABLE ...`. The validator accepts these payloads because they start with `SELECT` and certain side-effecting statements like `RENAME TABLE`, `SET`, `RESET`, `LOCK TABLES`, and `KILL` are not included in the blacklist. This issue was observed at the '/mcp/query' endpoint, enabling an MCP caller to perform backend writes or administrative SQL based on the target account's privileges. **Recommendations** Update to version 3.0.9. Keep MCP disabled unless required. Set a non-empty `mcp-query endpoint auth` token before exposing '/mcp/query'. Restrict MCP listener network exposure. Configure MCP backend target credentials as database-level read-only users. Add temporary MCP query rules to block multi-statement patterns.

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.7.0 through 3.7.2 **Description** An issue in the `SNICheck` domain-fronting protection allows an unauthenticated client to bypass mutual TLS (mTLS) enforced through wildcard router `TLSOptions`. When a router uses a wildcard host rule, such as `Host("*.example.com")`, with strict TLS options like `RequireAndVerifyClientCert`, the `SNICheck` middleware resolves TLS options for the HTTP `Host` header using only exact map lookups, failing to apply wildcard matching. An attacker can exploit this by completing a TLS handshake using a permissive SNI (Server Name Indication) available on the same entrypoint and then sending an HTTP `Host` header targeting the wildcard-protected backend. This allows the request to reach the backend without presenting a required client certificate. This behavior affects the standard HTTPS and HTTP-2 paths. **Recommendations** Update to version 3.7.3 or later. As a temporary workaround, avoid using wildcard router `TLSOptions` for mTLS access control. As a temporary workaround, enumerate exact protected hostnames instead of using wildcard `Host` rules. As a temporary workaround, enforce mTLS in the default TLS options. As a temporary workaround, avoid mixing permissive and mTLS-protected hosts on the same entrypoint. As a temporary workaround, block or reject domain-fronted requests at another network layer.

**Name of the Vulnerable Software and Affected Versions** Traefik versions 3.6.17 through 3.7.1 **Description** An issue in the HTTP/3 (QUIC) TLS configuration selection allows unauthenticated clients to bypass router-specific mutual TLS (mTLS) enforcement. When HTTP/3 is enabled, the TLS handshake uses an exact, case-sensitive lookup on the Server Name Indication (SNI) value to select the TLS configuration. This process fails to match wildcard host patterns (e.g., `*.example.com`) or case variants of the configured hostname. Consequently, the handshake falls back to the default TLS configuration, which may not require client certificates. However, the subsequent HTTP routing layer still matches the request to a backend protected by an mTLS policy, allowing the request to proceed without authentication. Technical details include: - **Vulnerable Function**: `GetTLSGetClientInfo()` performs the flawed map lookup. - **Vulnerable Parameters**: The `info.ServerName` variable is used for the case-sensitive lookup. **Recommendations** Update to version 3.7.3 or later. As a temporary workaround, disable HTTP/3 on entrypoints that rely on router-specific mTLS. As a temporary workaround, enforce mTLS in the default TLS options to ensure the fallback configuration is not weaker than router-specific settings. As a temporary workaround, block UDP access to the HTTP/3 entrypoint. As a temporary workaround, enforce client authentication at an additional layer behind the software.

**Name of the Vulnerable Software and Affected Versions** rclone versions 1.46.0 through 1.74.2 **Description** When the remote control API is enabled and the `--rc-serve` flag is used without HTTP authentication, the software accepts unauthenticated `GET` and `HEAD` requests to paths formatted as '/[remote:path]/object'. The `remote` value is parsed from the URL and passed to backend initialization. In versions 1.55.0 and later, inline remote configuration allows setting backend options that can execute local commands as the rclone process user. In versions 1.46.0 through 1.54.x, this mechanism allows for unauthenticated local file reads. Additionally, inline `global.*` options can mutate process-wide configuration, such as `global.http proxy`. This issue can be triggered by network attackers or via browser subresource requests against a localhost-only listener. **Recommendations** Update to version 1.74.3. Configure HTTP authentication using `--rc-user`, `--rc-pass`, or `--rc-htpasswd`. Disable the `--rc-serve` flag if file serving is not required.

**Name of the Vulnerable Software and Affected Versions** ProxySQL versions 2.0.18 through 3.0.8 **Description** ProxySQL contains a pre-authentication heap memory corruption issue within the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can trigger this by declaring an oversized first packet length. The software then passes this attacker-controlled length directly to the `recv()` function while writing into a fixed 32 KB input queue. **Recommendations** Update to version 3.0.9.