Threats affecting pkg:brew/uffizzi

Addressable versions 2.2.5 through 2.9.0 contain a URI normalization flaw where paths with certain '..' segments are incorrectly resolved, deviating from RFC 3986. This can cause an application that uses Addressable's normalized paths for allowlist checks but sends the original URI to other components to inadvertently allow access to unauthorized paths. The issue is fixed in version 2.9.1. Applications that use the same normalization for checks and requests or reject '..' segments are not affected.

Addressable versions prior to 2.9.1 contain a denial of service vulnerability in the URI path normalization function. The vulnerability arises because the normalize_path method operates in quadratic time relative to the number of nested dot segments in a URI path, causing excessive CPU consumption when processing specially crafted paths. This impacts operations that normalize, compare, or join URIs derived from untrusted input. The issue is fixed in version 2.9.1.

Addressable library versions 2.0.0 and later have a vulnerability in the display_uri method where Unicode bidirectional and invisible characters in Punycode-encoded hostnames can cause misleading visual representations. This can make malicious domains appear as trusted ones in user interfaces that display these URIs. The issue is fixed in version 2.9.1.

A vulnerability in the Addressable Ruby library's pure-Ruby IDNA implementation allows certain invalid Punycode A-labels to be decoded incorrectly by the to_unicode method. This causes display_uri to show misleading hostnames that differ from the actual host used in connections, potentially enabling attackers controlling a domain to impersonate other hosts in displayed URIs. The issue affects Addressable versions 2.0.0 and later when using the pure-Ruby implementation and is fixed in version 2.9.1. The native IDNA implementation is not affected.