Threats tagged 'bitnami'

An improper access check allows user to download vcard exports of com_contact contacts that are inaccessible.

Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing Pillow's documented decompression bomb protection and allowing excessive memory allocation. This issue is fixed in version 12.3.0.

Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger excessive C-heap allocation when loaded. This issue is fixed in version 12.3.0.

Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessive allocation during conversion or saving. This issue is fixed in version 12.3.0.

Pillow is a Python imaging library. Prior to 12.3.0, WindowsViewer.get_command() constructed a cmd.exe shell command by directly embedding a file path into an f-string without escaping and passed the result to subprocess.Popen(..., shell=True), allowing shell metacharacters in the file path to inject arbitrary cmd.exe commands. This issue is fixed in version 12.3.0.

Mastodon versions prior to 4.3.24, 4.4.18, and 4.5.11 contain a vulnerability where malformed <math> nodes cause an unhandled NoMethodError exception in the math sanitizer. This results in a persistent denial-of-service (DoS) condition affecting the entire server or specific user services depending on the context of the malformed input. The issue is fixed in versions 4.3.24, 4.4.18, and 4.5.11.

Mastodon versions from 4.3.0 up to but not including 4.4.18, and from 4.5.0 up to but not including 4.5.11, contain a vulnerability in the handling of attributionDomains in JSON-LD. This flaw allows an attacker to modify the attributionDomains value in a legitimately signed Update activity, bypassing Mastodon's signature verification and enabling spoofing of attribution domains. The issue is fixed in versions 4.4.18 and 4.5.11.

Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 have a vulnerability in the normalization of incoming signed activities. This flaw allows threat actors to remove JSON entries from valid signed activities, potentially enabling spoofing of activity data. The issue is fixed in versions 4.5.10, 4.4.17, and 4.3.23.

Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 using Ruby versions older than 3.4 have a Server-Side Request Forgery (SSRF) protection bypass. The vulnerability arises because PrivateAddressCheck.private_address? incorrectly returns false for IPv4-mapped IPv6 addresses, allowing attackers controlling DNS to redirect HTTP fetches to private IPv4 addresses such as loopback or cloud metadata endpoints. This issue is fixed in Mastodon versions 4.5.10, 4.4.17, and 4.3.23.

Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 have a vulnerability in the normalization of incoming activities signed with Linked-Data Signatures. This flaw allows attackers to rearrange a valid signed JSON-LD activity from a third party so that it is processed differently, potentially bypassing signature validation. The issue is fixed in versions 4.5.10, 4.4.17, and 4.3.23.

Mastodon versions prior to 4.5.10, 4.4.17, and 4.3.23 have an SSRF vulnerability due to incomplete filtering of IP address ranges. Attackers can exploit this by using IPv6 unspecified addresses (::) to bypass restrictions and make HTTP requests to local loopback interfaces, potentially accessing private resources. This issue is fixed in versions 4.5.10, 4.4.17, and 4.3.23.

These are all security issues fixed in the python314-3.14.7-1.1 package on the GA media of openSUSE Tumbleweed.

A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when requested through a parent group. This allows a delegated administrator to view details of child groups they are not authorized to access directly, including group names, paths, and custom attributes.

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

Contour versions 1.23.0 through 1.33.4 have a vulnerability where enabling fallback TLS certificates on virtual hosts with JWT providers configured allows requests without valid TLS SNI to bypass JWT verification. This misconfiguration results in unauthenticated requests being proxied to upstream services. The issue is fixed in version 1.33.5, which rejects invalid configurations combining fallback certificates and JWT providers.

Release of RHOAI 3.4.2 provides these changes:

SeaweedFS is a distributed storage system for object storage (S3), file systems, and Iceberg tables. Prior to 4.30, the S3 API gateway and the Iceberg REST catalog gateway construct their routers with mux.NewRouter().SkipClean(true). With path cleaning disabled, a .. segment inside the URL survives routing, so a request such as `GET /bucket-A/../evil-bucket/key`, is matched as bucket=bucket-A, object=../evil-bucket/key. The captured object key is then joined into a filer path with util.JoinPath (S3) / path.Join (Iceberg), which collapse the .. server-side, so the actual read or write lands in evil-bucket. This vulnerability is fixed in 4.30.

MariaDB server versions with the wsrep_notify_cmd feature enabled are vulnerable to command injection via the name of a joiner node. This vulnerability allows remote attackers to execute arbitrary shell commands on the server, potentially leading to full system compromise. Multiple MariaDB versions are affected. A security update is available that fixes this issue. Disabling the wsrep_notify_cmd feature is a recommended workaround for those unable to upgrade immediately.

A cross-site scripting (XSS) vulnerability exists in the number guess example application of Apache Tomcat. This vulnerability is due to improper neutralization of script-related HTML tags, allowing an attacker to inject malicious scripts. The issue affects multiple versions of Apache Tomcat, including versions from 7.0.0 through 7.0.109, 8.5.0 through 8.5.100, 9.0.0.M1 through 9.0.118, 10.1.0-M1 through 10.1.55, and 11.0.0-M1 through 11.0.22. Fixed versions have been released, and users are advised to upgrade to 11.0.23, 10.1.56, or 9.0.119 or later to remediate the issue. The vulnerability has a CVSS score of 6.1 (medium severity).

Red Hat JBoss Web Server 6.2.5 includes multiple security fixes addressing vulnerabilities in Apache Tomcat components such as security constraint bypass, authentication bypass, denial of service, and information disclosure. These issues affect various aspects including URL encoding in rewrite valves, access control, HTTP/2 resource allocation, and WebSocket session handling. The update replaces version 6.2.4 and is rated as having an important security impact by Red Hat.