Threats affecting pkg:brew/dvc

A denial-of-service (DoS) vulnerability exists in pyasn1 version 0.6.1 due to memory exhaustion caused by malformed RELATIVE-OID values with excessive continuation octets during decoding. An attacker can exploit this by crafting malicious X.509 certificates that trigger excessive memory consumption when parsed. This can cause affected systems such as LDAP servers, TLS/SSL endpoints, and OCSP responders to hang or stop services. A fix is available in version 3.66.1_2.

A vulnerability in the h11 HTTP/1.1 library (up to version 0.14.0) allows malformed chunked-encoding bodies to be accepted due to lenient parsing of trailing line terminators. This can cause discrepancies in how HTTP requests are interpreted between h11 and certain buggy proxies, potentially enabling HTTP request smuggling attacks. The issue is fixed in h11 version 0.15.0. Exploitation requires a combination of a vulnerable h11 server and a proxy with a specific parsing bug. The CVSS score is 9.1 (critical).

CVE-2024-35255 is an elevation of privilege vulnerability affecting Azure Identity Libraries and Microsoft Authentication Library versions from 2.0.1 up to but not including 3.51.2_1. The vulnerability allows a user with limited privileges to elevate their privileges. A fix is available in version 3.51.2_1.

A vulnerability in PyJWT's issuer ('iss') claim validation allows partial string matches instead of exact matches due to a type-checking bug introduced in version 2.10.0. This causes tokens with incorrect issuer values that partially match the expected issuer string to be accepted. The signature validation remains intact, limiting the impact.

AsyncSSH versions 2.14.1 and earlier are vulnerable to a prefix truncation attack (Terrapin attack) targeting the ChaCha20-Poly1305 and Encrypt-then-MAC SSH algorithms. This attack allows a man-in-the-middle to strip messages after the initial key exchange, breaking SSH extension negotiation and downgrading connection security. The vulnerability exploits the lack of authentication for SSH_MSG_IGNORE messages and sequence number checks only after key exchange. The attack is guaranteed to work on ChaCha20-Poly1305 and requires CBC ciphers for practical exploitation of Encrypt-then-MAC. A patch is available that implements a 'strict kex' handshake to prevent this attack, requiring support on both client and server sides. As a temporary mitigation, disabling affected algorithms and using alternatives like AES-GCM is recommended.

AsyncSSH versions prior to 3.67.1_7 contain a vulnerability where a peer-supplied send_pktsize value of zero causes a synchronous loop to become permanently true without awaiting, freezing the connection. This denial of service can be triggered by a malicious SSH server or an authenticated client, affecting current and future connections. The issue is fixed in version 3.67.1_7.

AsyncSSH versions through 2.23.0 have a path traversal vulnerability in the SCP client. A malicious SSH server can exploit this to write files outside the intended directory, potentially overwriting critical user files like ~/.bashrc or ~/.ssh/authorized_keys. This could lead to code execution. The issue is fixed in AsyncSSH version 3.67.1_7.