Uzlopak

**Name of the Vulnerable Software and Affected Versions** Undici versions prior to 5.28.4 Undici versions prior to 6.11.1 **Description** The issue is related to insufficient access control in the Undici HTTP/1.1 client for Node.js, allowing a remote attacker to execute arbitrary code by altering the `integrity` option passed to `fetch()`. This enables `fetch()` to accept tampered requests as valid. **Recommendations** For versions prior to 5.28.4, update to version 5.28.4 or later. For versions prior to 6.11.1, update to version 6.11.1 or later. As a temporary workaround, ensure that the `integrity` option cannot be tampered with to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** @fastify/bearer-auth versions prior to 7.0.2 and 8.0.1 fastify-bearer-auth versions 5.0.1 through 6.0.3 **Description** The issue is related to the insecure use of crypto.timingSafeEqual in @fastify/bearer-auth, allowing a malicious attacker to estimate the length of one valid bearer token. According to RFC 6750, the bearer token has only base64 valid characters, reducing the range of characters for a brute force attack. **Recommendations** For @fastify/bearer-auth versions prior to 7.0.2, upgrade to version 7.0.2 or later. For @fastify/bearer-auth versions prior to 8.0.1, upgrade to version 8.0.1 or later. For fastify-bearer-auth versions 5.0.1 through 6.0.3, upgrade to a patched version of @fastify/bearer-auth.

**Name of the Vulnerable Software and Affected Versions** github-action-merge-dependabot versions prior to 3.2.0 **Description** github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, it does not check if a commit created by dependabot is verified with the proper GPG key. There is just a check if the actor is set to `dependabot[bot]` to determine if the PR is a legit PR. Theoretically, an owner of a seemingly valid and legit action in the pipeline can check if the PR is created by dependabot and if their own action has enough permissions to modify the PR in the pipeline. If so, they can modify the PR by adding a second seemingly valid and legit commit to the PR, as they can set arbitrarily the `username` and `email` in for commits in git. Because the bot only checks if the actor is valid, it would pass the malicious changes through and merge the PR automatically, without getting noticed by project maintainers. It would probably not be possible to determine where the malicious commit came from, as it would only say `dependabot[bot]` and the corresponding email-address. **Recommendations** For versions prior to 3.2.0, update to version 3.2.0 or later to resolve the issue. As a temporary workaround, consider manually verifying the commits in dependabot pull requests before merging them. Restrict access to the pipeline to minimize the risk of exploitation. Avoid using the `username` and `email` variables in git commits until the issue is resolved.