Threats tagged 'ghsa-q3ph-3gv2-g5wq'

Psono Server CE and EE versions 0.1.0 through 7.2.3 contain a vulnerability where an authenticated user can specify a host when configuring a personal Duo device. The server connects to the specified host over HTTPS without an allowlist or explicit timeout, enabling an internal DNS and service-reachability oracle. TLS certificate validation is enforced, and arbitrary protocols or ports are not accessible. Unresponsive targets can cause server worker resource exhaustion until the OS timeout occurs.