Vulnerabilidades

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n<br /> <br /> On CONFIG_INET=n builds, mpls_valid_fib_dump_req() walks the parsed<br /> attribute table itself instead of calling ip_valid_fib_dump_req(). The<br /> RTA_OIF arm passes tb[RTA_OIF] to nla_get_u32() without checking it is<br /> present, so an RTM_GETROUTE dump for AF_MPLS with strict checking and no<br /> RTA_OIF hits a NULL dereference.<br /> <br /> RTM_GETROUTE is RTNL_KIND_GET, which rtnetlink_rcv_msg() permits without<br /> CAP_NET_ADMIN, so an unprivileged user can trigger it.<br /> <br /> Oops: general protection fault, probably for non-canonical address<br /> 0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI<br /> KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]<br /> RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)<br /> Call Trace:<br /> mpls_dump_routes (net/mpls/af_mpls.c:2236)<br /> netlink_dump (net/netlink/af_netlink.c:2331)<br /> __netlink_dump_start (net/netlink/af_netlink.c:2446)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7033)<br /> netlink_rcv_skb (net/netlink/af_netlink.c:2556)<br /> netlink_unicast (net/netlink/af_netlink.c:1345)<br /> netlink_sendmsg (net/netlink/af_netlink.c:1900)<br /> __sock_sendmsg (net/socket.c:790)<br /> ____sys_sendmsg (net/socket.c:2684)<br /> ___sys_sendmsg (net/socket.c:2738)<br /> __sys_sendmsg (net/socket.c:2770)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:94)<br /> entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)<br /> <br /> Skip unset attributes, as ip_valid_fib_dump_req() does.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: mac80211: fix fils_discovery double free on alloc failure<br /> <br /> ieee80211_set_fils_discovery() calls kfree_rcu() on the old template<br /> before allocating the replacement. If the kzalloc() then fails, it<br /> returns -ENOMEM while link-&gt;u.ap.fils_discovery still points at the<br /> object already queued for freeing. A later update or AP teardown<br /> (ieee80211_stop_ap()) re-queues that same rcu_head; the second free is<br /> caught by KASAN when the RCU sheaf is processed in softirq:<br /> <br /> BUG: KASAN: double-free in rcu_free_sheaf (mm/slub.c:5850)<br /> Free of addr ffff88800c065280 by task swapper/0/0<br /> ...<br /> __rcu_free_sheaf_prepare (mm/slub.c:2634 mm/slub.c:2940)<br /> rcu_free_sheaf (mm/slub.c:5850)<br /> rcu_core (kernel/rcu/tree.c:2617 kernel/rcu/tree.c:2869)<br /> handle_softirqs (kernel/softirq.c:622)<br /> The buggy address belongs to the cache kmalloc-96 of size 96<br /> <br /> Queue the old object for kfree_rcu() only after the new one is published,<br /> matching ieee80211_set_probe_resp() and ieee80211_set_s1g_short_beacon().

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> wifi: p54: validate RX frame length in p54_rx_eeprom_readback()<br /> <br /> p54_rx_eeprom_readback() copies the requested EEPROM slice out of a<br /> device-supplied readback frame without checking that the skb actually holds<br /> that many bytes. Commit da1b9a55ff11 ("wifi: p54: prevent buffer-overflow in<br /> p54_rx_eeprom_readback()") closed the destination overflow by copying a<br /> fixed priv-&gt;eeprom_slice_size (and rejecting a mismatched advertised len),<br /> but the source side is still unbounded: nothing verifies the frame is long<br /> enough to supply that many bytes.<br /> <br /> A malicious USB device can send a short frame whose advertised len matches<br /> priv-&gt;eeprom_slice_size while the payload is truncated. The equality check<br /> passes and memcpy() reads past the end of the skb, leaking adjacent heap:<br /> <br /> BUG: KASAN: slab-out-of-bounds in p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)<br /> Read of size 1016 at addr ffff88800f077114 by task swapper/0/0<br /> Call Trace:<br /> <br /> ...<br /> __asan_memcpy (mm/kasan/shadow.c:105)<br /> p54_rx (drivers/net/wireless/intersil/p54/txrx.c:507)<br /> p54u_rx_cb (drivers/net/wireless/intersil/p54/p54usb.c:163)<br /> __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1657)<br /> dummy_timer (drivers/usb/gadget/udc/dummy_hcd.c:2005)<br /> ...<br /> <br /> <br /> The buggy address belongs to the object at ffff88800f0770c0<br /> which belongs to the cache skbuff_small_head of size 704<br /> The buggy address is located 84 bytes inside of<br /> allocated 704-byte region [ffff88800f0770c0, ffff88800f077380)<br /> <br /> Check that the slice fits in the skb before copying.

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: fib: free fib_alias with kfree_rcu() on insert error path<br /> <br /> fib_table_insert() publishes new_fa into the leaf&amp;#39;s fa_list with<br /> fib_insert_alias() before calling the fib entry notifiers. When a<br /> notifier fails, the error path removes new_fa with fib_remove_alias()<br /> (hlist_del_rcu) and frees it right away with kmem_cache_free().<br /> <br /> fib_table_lookup() walks that list under rcu_read_lock() only, so a<br /> concurrent lookup that already reached new_fa keeps reading it after the<br /> free:<br /> <br /> BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)<br /> Read of size 1 at addr ffff88810676d4eb by task exploit/297<br /> Call Trace:<br /> fib_table_lookup (net/ipv4/fib_trie.c:1601)<br /> ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)<br /> ip_route_output_key_hash (net/ipv4/route.c:2705)<br /> __ip4_datagram_connect (net/ipv4/datagram.c:49)<br /> udp_connect (net/ipv4/udp.c:2144)<br /> __sys_connect (net/socket.c:2167)<br /> __x64_sys_connect (net/socket.c:2173)<br /> do_syscall_64<br /> entry_SYSCALL_64_after_hwframe<br /> which belongs to the cache ip_fib_alias of size 56<br /> <br /> Triggering the error path needs CAP_NET_ADMIN and a registered fib<br /> notifier that can reject a route; a netdevsim device whose IPv4 FIB<br /> resource is exhausted is enough.<br /> <br /> Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already<br /> does for a fib_alias removed from the trie.

*** Pendiente de traducción *** The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. This is due to missing capability checks in the `plupload_ajax_delete_file()` function, which is registered via `wp_ajax_nopriv_gfmu_delete_file`. The nonce intended for CSRF protection is exposed on any public-facing page containing a multi-uploader form field via the `GFMU_options` JavaScript object. This makes it possible for unauthenticated attackers to permanently delete any WordPress media attachment by supplying its attachment ID, potentially leading to complete media library destruction.

*** Pendiente de traducción *** The Askeet plugin for WordPress is vulnerable to SQL Injection via the &amp;#39;sql_query&amp;#39; parameter in multiple AJAX actions (askeet_execute_sql_query, askeet_export_all_results) in all versions up to, and including, 3.0. This is due to the askeet_is_safe_query() filter being bypassable using MySQL conditional comments (e.g., /*!UNION*/). The filter strips regular block comments before checking for forbidden SQL keywords, but MySQL interprets conditional comments as executable code. This makes it possible for authenticated attackers, with Administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.

*** Pendiente de traducción *** ** UNSUPPORTED WHEN ASSIGNED ** Uncontrolled Recursion vulnerability in Apache Lucy.<br /> <br /> This issue affects Apache Lucy: all versions.<br /> <br /> As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.<br /> <br /> NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

*** Pendiente de traducción *** ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of Untrusted Data vulnerability in Apache Lucy.<br /> <br /> This issue affects Apache Lucy: all versions.<br /> <br /> As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.<br /> <br /> NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

*** Pendiente de traducción *** ** UNSUPPORTED WHEN ASSIGNED ** Memory Allocation with Excessive Size Value vulnerability in Apache Lucy.<br /> <br /> This issue affects Apache Lucy: all versions.<br /> <br /> As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.<br /> <br /> NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

*** Pendiente de traducción *** ** UNSUPPORTED WHEN ASSIGNED ** Stack-based Buffer Overflow vulnerability in Apache Lucy.<br /> <br /> This issue affects Apache Lucy: all versions.<br /> <br /> As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative or restrict access to the instance to trusted users.<br /> <br /> NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

*** Pendiente de traducción *** The pocketflow-coding-agent cookbook example in The-Pocket/PocketFlow implements a `_path(workdir, p)` helper as a thin os.path.join(workdir, p) wrapper with no canonicalization or containment check, used unguarded by the ReadFile, ListFiles, PatchRead, and PatchApply file-access tools. Because os.path.join returns an absolute `p` unchanged (ignoring workdir) and does not resolve &amp;#39;../&amp;#39; sequences, an agent invocation whose file-tool arguments include an absolute path or a traversal sequence can read or write files outside the configured working directory. Severity reflects that this affects an illustrative cookbook example rather than a core library API; applications that copy this pattern into production are affected.

*** Pendiente de traducción *** A denial-of-service vulnerability was identified in multiple TLS listeners in Rancher. Both the cattle-cluster-agent component running in downstream clusters and the Rancher server itself use the dynamiclistener library to serve TLS traffic. Without an effective CN filter configured, dynamiclistener automatically appended to each serving certificate any hostname presented via Server Name Indication (SNI) in incoming TLS requests.<br /> <br /> <br /> <br /> An unauthenticated attacker with network access within the affected cluster could send a large number of TLS requests with distinct hostnames, causing the serving certificate to accumulate an unbounded number of Subject Alternative Names (SANs). Eventually, the certificate grows large enough that TLS handshakes fail with an excessive message size error, causing a denial of service on the affected listeners.