Thomas-Chauchefoin-Sonarsource

**Name of the Vulnerable Software and Affected Versions** Composer versions prior to 1.10.27 Composer versions prior to 2.2.22 Composer versions prior to 2.6.4 **Description** The issue is related to the Composer dependency manager for PHP. Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be subject to a remote code execution vulnerability if PHP also has `register argc argv` enabled in php.ini. **Recommendations** For versions prior to 1.10.27, upgrade to version 1.10.27 or later. For versions prior to 2.2.22, upgrade to version 2.2.22 or later. For versions prior to 2.6.4, upgrade to version 2.6.4 or later. As a temporary workaround, consider disabling the `register argc argv` setting in php.ini to minimize the risk of exploitation. Avoid publishing composer.phar to the web as this is not best practice.

**Name of the Vulnerable Software and Affected Versions** CasaOS versions prior to 0.4.4 **Description** CasaOS is an open-source Personal Cloud system. Due to a lack of IP address verification, an unauthenticated attacker can execute arbitrary commands as `root` on CasaOS instances. The problem was addressed by improving the detection of client IP addresses. **Recommendations** For versions prior to 0.4.4, upgrade to CasaOS 0.4.4. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly.

**Name of the Vulnerable Software and Affected Versions** CasaOS versions prior to 0.4.4 **Description** Unauthenticated attackers can craft arbitrary JWTs and access features that usually require authentication, allowing them to execute arbitrary commands as `root` on CasaOS instances. This issue is related to weaknesses in the authentication procedure, specifically in the validation of JWTs. **Recommendations** For versions prior to 0.4.4, upgrade to CasaOS 0.4.4 to resolve the issue. If upgrading to 0.4.4 is not possible, temporarily restrict access to CasaOS to untrusted users, for instance by not exposing it publicly, to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Pacparser versions prior to 1.4.2 **Description** The issue allows JavaScript injection, and possibly privilege escalation, when the attacker controls the URL, which may be realistic within enterprise security products. **Recommendations** For versions prior to 1.4.2, update to version 1.4.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the `pacparser find proxy` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Soko versions prior to 1.0.2 **Description** The issue affects the package search handlers, `Search` and `SearchFeed`, implemented in `pkg/app/handler/packages/search.go`, allowing unauthenticated attackers to execute arbitrary SQL queries on `https://packages.gentoo.org/` via the `q` parameter. This can lead to code execution in the context of the PostgreSQL container. The issue was addressed using prepared statements to interpolate user-controlled data in SQL queries. **Recommendations** For versions prior to 1.0.2, update to version 1.0.2 or later, which includes the fix for the SQL injection issue by using prepared statements to interpolate user-controlled data in SQL queries. As a temporary workaround, consider restricting access to the `Search` and `SearchFeed` handlers until the update can be applied. Avoid using the `q` parameter in the affected API endpoint until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Crypt GPG extension for PHP versions prior to 1.6.7 **Description** The issue concerns the Crypt GPG extension for PHP, where it fails to prevent additional options in GPG calls. This poses a risk for certain environments and GPG versions. **Recommendations** For versions prior to 1.6.7, update to version 1.6.7 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Icinga Web 2 versions prior to 2.9.6 and 2.10 **Description** The issue allows unauthenticated users to leak the contents of files on the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. This is due to insufficient path name restrictions in the PHP framework. An attacker can exploit this to execute arbitrary code remotely. **Recommendations** For versions prior to 2.9.6, update to version 2.9.6 or later. For versions prior to 2.10, update to version 2.10 or later. As a general measure, rotate database credentials to minimize potential damage from leaked credentials.

**Name of the Vulnerable Software and Affected Versions** Composer versions prior to 1.10.22 Composer versions prior to 2.0.13 **Description** The issue is related to the incorrect sanitization of URLs for Mercurial repositories in the root composer.json and package source download URLs. This allows specifically crafted URL values to execute code in the HgDriver if hg/Mercurial is installed on the system. The impact is mainly to services passing user input to Composer, including Packagist.org and Private Packagist, as it allows users to trigger remote code execution. The vulnerability has been patched on Packagist.org and Private Packagist within 12 hours of receiving the initial vulnerability report, and based on a review of logs, it is believed that the vulnerability was not abused by anyone. **Recommendations** For versions prior to 1.10.22, upgrade to version 1.10.22 or later to patch the issue. For versions prior to 2.0.13, upgrade to version 2.0.13 or later to patch the issue. As a temporary workaround, consider disabling the HgDriver until a patch is available. Restrict access to the VcsRepository/VcsDriver or derivatives to minimize the risk of exploitation. Avoid using specially crafted URL values in the composer.json file and package source download URLs until the issue is resolved.