Threats affecting pkg:brew/licensee

Addressable versions 2.2.5 through 2.9.0 contain a URI normalization flaw where paths with multiple '..' segments are incorrectly resolved, deviating from RFC 3986. This can cause normalized paths to appear within an allowed directory while the original path actually points outside it, potentially enabling path traversal bypasses of allowlist checks. The issue is fixed in version 2.9.1. Applications that use Addressable's normalized path for access control but send the original URI to other components that resolve paths correctly are vulnerable. Rejecting paths with '..' segments or upgrading to 2.9.1 mitigates the issue.

Addressable versions prior to 2.9.1 contain a denial of service vulnerability in the URI path normalization function. The vulnerability arises because the normalize_path method processes nested dot segments in a path with quadratic time complexity, leading to excessive CPU consumption when handling specially crafted long paths. This can cause denial of service when normalizing, comparing, or joining URIs derived from untrusted input. The issue is fixed in version 2.9.1.

Addressable library versions 2.0.0 and later have an issue where the display_uri method can show misleading hostnames containing bidirectional and invisible Unicode characters. This can cause visually deceptive domain names that appear similar to trusted hosts, potentially enabling phishing or spoofing attacks in user interfaces that display these URIs. The underlying host parsing and connections are not affected. The issue is fixed in version 2.9.1.

A vulnerability in the pure-Ruby IDNA implementation of Addressable allows certain invalid Punycode A-labels to be decoded incorrectly by the to_unicode method. This causes the display_uri method to show misleading hostnames that differ from the actual host used in connections. An attacker controlling a domain with such a label can have a URI displayed as a host they do not control, potentially misleading applications that rely on display_uri or to_unicode for security decisions. The native IDNA implementation is not affected. The issue is fixed in Addressable version 2.9.1.