Threats tagged 'ghsa-qwr3-mfw3-8qfr'

Tinyproxy versions through 1.11.3 have an access control bypass vulnerability in the acl_string_processing() function. The flaw arises because the function compares only trailing hostname characters without validating DNS label boundaries. This allows an attacker who controls the PTR record for their IP address to bypass deny-by-default access control lists (ACLs) by matching allowed hostnames improperly.