Last updated 24 July 2024
VMware Tools contains a SAML token signature bypass vulnerability. A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html .
Automation. The issue was addressed with improved checks.
A logic issue was addressed with improved checks. This issue is fixed in iOS 17.1 and iPadOS 17.1, watchOS 10.1, iOS 16.7.2 and iPadOS 16.7.2, macOS Sonoma 14.1, Safari 17.1, tvOS 17.1. Processing web content may lead to arbitrary code execution.
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.9.0.
Chromium: CVE-2023-5857 Inappropriate implementation in Downloads
Last updated 24 July 2024
Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2.
Users are recommended to upgrade to version 9.2.3, which fixes the issue.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Traffic Server.This issue affects Apache Traffic Server: from 8.0.0 through 8.1.8, from 9.0.0 through 9.2.2.
Users are recommended to upgrade to version 8.1.9 or 9.2.3, which fixes the issue.
Chromium: CVE-2023-5856 Use after free in Side Panel
Chromium: CVE-2023-5480 Inappropriate implementation in Payments
Chromium: CVE-2023-5855 Use after free in Reading Mode
Chromium: CVE-2023-5482 Insufficient data validation in USB
Chromium: CVE-2023-5849 Integer overflow in USB
Impact
Undici clears Authorization headers on cross-origin redirects, but does not clear Cookie headers. By design, cookie headers are forbidden request headers, disallowing them to be set in RequestInit.headers in browser environments. Since Undici handles headers more liberally than the specification, there was a disconnect from the assumptions the spec made, and Undici's implementation of fetch.
As such this may lead to accidental leakage of cookie to a 3rd-party site or a malicious attacker who can control the redirection target (ie. an open redirector) to leak the cookie to the 3rd party site.
Patches
This was patched in e041de359221ebeae04c469e8aff4145764e6d76, which is included in version 5.26.2.
The course upload preview contained an XSS risk for users uploading unsafe data.
ID numbers displayed in the quiz grading report required additional sanitizing to prevent a stored XSS risk.
Wiki comments required additional sanitizing and access restrictions to prevent a stored XSS risk and potential IDOR risk.
Last updated 24 July 2024
An integer overflow in xerces-c++ 3.2.3 in BigFix Platform allows remote attackers to cause out-of-bound access via HTTP request.
Impact A malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service.
Homeservers running on a closed federation (which presumably do not need to use server ACLs) are not affected.
Patches Server administrators are advised to upgrade to Synapse 1.94.0 or later.
Workarounds Rooms with malicious server ACL events can be purged and blocked using the admin API.
Last updated 24 July 2024
A vulnerability was found in libXpm due to a boundary condition within the XpmCreateXpmImageFromBuffer() function. This flaw allows a local attacker to trigger an out-of-bounds read error and read the contents of memory on the system.
Chromium: CVE-2023-5854 Use after free in Profiles
Last updated 24 July 2024
Impact
Users publishing a composer.phar to a public web-accessible server where the composer.phar can be executed as a php file may be impacted if PHP also has registerargcargv enabled in php.ini.
Patches
2.6.4, 2.2.22 and 1.10.27 patch this vulnerability.
Workarounds
Make sure registerargcargv is disabled in php.ini, and avoid publishing composer.phar to the web as this really should not happen.
Chromium: CVE-2023-5218 Use after free in Site Isolation
Impact Users were able to forge read receipts for any event (if they knew the room ID and event ID). Note that the users were not able to view the events, but simply mark it as read. This could be confusing as clients will show the event as read by the user, even if they are not in the room.
Patches https://github.com/matrix-org/synapse/pull/16327
Workarounds There is no workaround.
Impact
When users update their passwords, the new credentials may be briefly held in the server database. While this doesn't grant the server any added capabilities—it already learns the users' passwords as part of the authentication process—it does disrupt the expectation that passwords won't be stored in the database. As a result, these passwords could inadvertently be captured in database backups for a longer duration.
These temporarily stored passwords are automatically erased after a 48-hour window.
Patches https://github.com/matrix-org/synapse/pull/16272
References
This bug was due to a regression in https://github.com/matrix-org/synapse/pull/13188.
Summary In the AES GCM implementation of decryptinplacedetached, the decrypted ciphertext (i.e. the correct plaintext) is exposed even if tag verification fails.
Impact If a program using the aes-gcm crate's decryptinplace APIs accesses the buffer after decryption failure, it will contain a decryption of an unauthenticated input. Depending on the specific nature of the program this may enable Chosen Ciphertext Attacks (CCAs) which can cause a catastrophic breakage of the cipher including full plaintext recovery.
Details As seen in the implementation of decryptinplacedetached for AES GCM, if the tag verification fails, an error is returned. Because the decryption of the ciphertext is done in place, the plaintext contents are now exposed via buffer.
This should ideally not be the case - as noted in page 17 of NIST's publication Recommendation for Block Cipher Modes of Operation: Galois/Counter Mode (GCM) and GMAC: In Step 8, the result of Step 7 is compared with the authentication tag that was received as an input: if they are identical, then the plaintext is returned; otherwise,FAIL is returned.
This is seems correctly addressed in the AES GCM SIV implementation, where the decrypted buffer is encrypted again before the error is returned - this fix is straightforward to implement in AES GCM. To ensure that these types of cases are covered during testing, it would be valuable to add test cases like 23, 24 etc from project wycheproof to ensure that when a bad tag is used, there is an error on decryption and that the plaintext value is not exposed.
PoC To reproduce this issue, I'm using test case 23 from project wycheproof. rust let key = GenericArray::fromslice(&hex!("000102030405060708090a0b0c0d0e0f")); let nonce = GenericArray::fromslice(&hex!("505152535455565758595a5b")); let tag = GenericArray::fromslice(&hex!("d9847dbc326a06e988c77ad3863e6083")); // bad tag let mut ct = hex!("eb156d081ed6b6b55f4612f021d87b39"); let msg = hex!("202122232425262728292a2b2c2d2e2f"); let aad = hex!(""); let cipher = Aes128Gcm::new(&key); let plaintext = cipher.decryptinplacedetached(&nonce, &aad, &mut ct, &tag); asserteq!(ct, msg);