An out-of-bounds write vulnerability exists in the drill format T-code tool number functionality of Gerbv 2.7.0, dev (commit b5f1eacd), and the forked version of Gerbv (commit 71493260). A specially-crafted drill file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

A use-after-free vulnerability exists in the RS-274X aperture definition tokenization functionality of Gerbv 2.7.0 and dev (commit b5f1eacd) and Gerbv forked 2.7.1. A specially-crafted gerber file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.

Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java object deserialization within an application. In such situations, it allows attackers to erase contents of arbitrary files, make network connections, or possibly run arbitrary code (specifically, Function0 functions) via a gadget chain.

OWASP ModSecurity Core Rule Set 3.1.x before 3.1.2, 3.2.x before 3.2.1, and 3.3.x before 3.3.2 is affected by a Request Body Bypass via a trailing pathname.

Impact

If PAM is correctly configured and a user account is set to expired, the expired user-account is still able to successfully log into Cobbler in all places (Web UI, CLI & XMLRPC-API).

The same applies to user accounts with passwords set to be expired.

Patches

There is a patch for the latest Cobbler 3.3.2 available, however a backport will be done for 3.2.x.

Workarounds

- Delete expired accounts which are able to access Cobbler via PAM. - Use chage -l <username> to lock the account. If the account has SSH-Keys attached then remove them completely.

References

- Originally discovered by @ysf at https://www.huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d/

How to test if my Cobbler instance is affected?

The following pytest test assumes that your PAM setup is correct. In case the added user is not able to login, this test does not make sense to be executed.

python def testpamloginwithexpireduser(): # Arrange # create pam testuser testusername = "expireduser" testpassword = "password" testapi = CobblerAPI() subprocess1 = subprocess.run( ["perl", "-e", "'print crypt(\"%s\", \"%s\")'" % (testusername, testpassword)], stdout=subprocess.PIPE ) subprocess.run(["useradd", "-p", subprocess1.stdout, testusername]) # change user to be expired subprocess.run(["chage", "-E0", testusername])

# Act result = pam.authenticate(testapi, testusername, testpassword)

# Assert - login should fail assert not result

For more information If you have any questions or comments about this advisory: Open an issue in the Cobbler repository Ask in the Gitter/Matrix Chat Email us at cobbler.project@gmail.com

URL Restriction Bypass in GitHub repository plantuml/plantuml prior to V1.2022.5. An attacker can abuse this to bypass URL restrictions that are imposed by the different security profiles and achieve server side request forgery (SSRF). This allows accessing restricted internal resources/servers or sending requests to third party servers.

Hello Team, please check the below report: --------

Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and the verifier for validating the integrity quote.

This allows an attacker to use one AK, EK pair from a real TPM to pass EK validation and give the verifier an AK of a software TPM.

Affects all versions of Keylime <6.4.0

Thanks

Chromium: CVE-2023-1820 Heap buffer overflow in Browser History

Chromium: CVE-2023-1812 Out of bounds memory access in DOM Bindings

Chromium: CVE-2023-1533 Use after free in WebProtect

Chromium: CVE-2023-1528 Use after free in Passwords

Chromium: CVE-2023-1815 Use after free in Networking APIs

Chromium: CVE-2023-2134 Out of bounds memory access in Service Worker API

Chromium: CVE-2023-2133 Out of bounds memory access in Service Worker API

Chromium: CVE-2023-1818 Use after free in Vulkan

A code execution vulnerability exists in the DLDxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.

Chromium: CVE-2023-1532 Out of bounds read in GPU Video

An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function checkforinvalidimports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)

ownCloud owncloud/client before 2.9.2 allows Resource Injection by a server into the desktop client via a URL, leading to remote code execution.

Teeworlds up to and including 0.7.5 is vulnerable to Buffer Overflow. A map parser does not validate mChannels value coming from a map file, leading to a buffer overflow. A malicious server may offer a specially crafted map that will overwrite client's stack causing denial of service or code execution.

RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file

Chromium: CVE-2023-2135 Use after free in DevTools

AMD. A memory corruption issue was addressed with improved input validation.

In Mbed TLS before 3.1.0, psaaeadgeneratenonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application.

Impact Untrusted websocket connections can cause an out-of-memory (OOM) process abort in a client or a server. The root cause of the issue is during dataframe parsing. Affected versions would allocate a buffer based on the declared dataframe size, which may come from an untrusted source. When Vec::withcapacity fails to allocate, the default Rust allocator will abort the current process, killing all threads. This affects only sync (non-Tokio) implementation. Async version also does not limit memory, but does not use withcapacity, so DoS can happen only when bytes for oversized dataframe or message actually got delivered by the attacker.

This is a security concern for you, if - your server application handles untrusted websocket connections - OR your client application connects to untrusted websocket servers

Patches The crashes are fixed in version 0.26.5 by imposing default dataframe size limits. Affected users are advised to update to this version.

Note that default memory limits are rather large (100MB dataframes and 200 MB messages), so they can still cause DoS in some environments (i.e. 32-bit). New API has been added to fine tune those limits for specific applications.

Workarounds

Migrate your project to another, maintained Websocket library like Tungstenite. Accept only trusted WebSocket traffic. Filter the WebSocket traffic though some kind of proxy that ensures sanity limits on messages. Handle process aborts gracefully and limit process memory using OS tools.

Credits This issue was reported by Evan Richter at ForAllSecure and found with Mayhem and Cargo Fuzz.

A memory leak bug in jasper 3.0.6 in function cmdoptsparse.

https://github.com/jasper-software/jasper/issues/332 https://github.com/jasper-software/jasper/commit/d99636fad60629785efd1ef72da772a8ef68f54c

An issue was discovered in Cobbler before 3.3.1. Files in /etc/cobbler are world readable. Two of those files contain some sensitive information that can be exposed to a local user who has non-privileged access to the server. The users.digest file contains the sha2-512 digest of users in a Cobbler local installation. In the case of an easy-to-guess password, it's trivial to obtain the plaintext string. The settings.yaml file contains secrets such as the hashed default password.

Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.

Chromium: CVE-2023-1817 Insufficient policy enforcement in Intents

Chromium: CVE-2023-1816 Incorrect security UI in Picture In Picture