취약점·업데이트
8페이지
10월 20일 (화)
Quarterly contributor outreach
Hi Django community, thank you all for continuing to contribute to Django. The Steering Council is reaching out to bring people's attention to a few areas. We have major features we'd like to test and review for 6.2 , smaller changes that could use attention and then various New Feature ideas we'd like community input on. Major features These PRs are things we'd like to refine, test and get merged in. We're looking for people to test the features themselves and review the PRs . Please see our guidelines on reviewing PRs . CompositeField (multi-column subqueries) (this only needs testing, not…
aiohttp server lacks an initial request/header timeout
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The keepalive timeout was not used during the initial portion of a request. Impact An attacker could keep an idle connection open indefinitely before sending any data. Workaround Use a reverse proxy (as recommended for all production deployments) with sensible keepalive limits.
AIOHTTP: Secure attribute not enforced for shared cookie
影響: pip:aiohttp <= 3.14.3 → 3.14.4 The Secure attribute was not being enforced for the shared cookie. Impact It may be possible to send a shared cookie marked Secure through an unencrypted request.
aiohttp: Multiple instances of excessive or unbounded memory/CPU use
影響: pip:aiohttp <= 3.14.3 → 3.14.4 Multiple cases were found where aiohttp could use excessive or unbounded memory, or excessive CPU consumption on attacker controlled requests. Impact An attacker could cause resource exhaustion through specially crafted requests.
russh: Unbounded memory allocation in agent protocol server via crafted constraint records
影響: rust:russh <= 0.64.0 → 0.64.1 russh_keys::agent::server::add_key (russh/src/keys/agent/server.rs:271-319) spawns a dedicated tokio task for every 5-byte SSH_AGENT_CONSTRAIN_LIFETIME record attached to an added key, each cloning the key blob and sleeping for the declared lifetime (up to ~136 years). The loop has no per-request task budget, and spawned tasks are not rolled back when the overall request fails. Repeating one constrained add-key message over an agent connection converts wire bytes into resident tasks and…
A russh SSH server accepts a publickey authentication whose signature uses a different algorithm than the one named in the request
影響: rust:russh >= 0.34.0-beta.1, < 0.64.0 → 0.64.0 In russh/src/server/encrypted.rs, server_read_auth_request_pk (0.63.3, around lines 880-990): The requested algorithm name (pubkey_algo) is read and only used to decode the key: PublicKeyOrCertificate::decode(&pubkey_algo, &pubkey_key). The derived hash_alg is then dropped (PublicKeyOrCertificate::PublicKey { ref key, .. }). The signature blob is decoded (Signature::decode) and verified with Verifier::verify(&pubkey, &buf, &sig). ssh-key picks the hash from the signature's own algorithm…
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
影響: pip:mercury >= 3.0.0, < 3.2.11 → 3.2.11 Mercury turns Jupyter notebooks into shared web apps/dashboards. The mr.Markdown widget converts its input to HTML with python-markdown and no sanitization step. MarkdownWidget is an ipywidgets.HTML widget, whose value is written to the page as raw HTML (via innerHTML) with no sanitization, so the result reaches the DOM verbatim. When an app passes untrusted data (database rows, user submissions, uploaded file contents, or an external/LLM API response) to mr.Markdown, HTML/JS in that da…
Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass
影響: pip:mercury >= 3.0.0, <= 3.2.3 → 3.2.4 A missing comma in mercury_app/block_handler.py's BLOCKED_PATTERNS list causes the blocklist to fail to cover the /api/terminals endpoint. As a result, any unauthenticated attacker can spawn a full, interactive OS-level shell on the host running Mercury. Details The blocklist in mercury_app/block_handler.py is defined as: BLOCKED_PATTERNS = [ # JupyterLab UI + API r"/lab(?!/(?:extensions/|api/settings(?:/|$)|api/translations(?:/|$)))(?:/.)?" r"/api/terminals(?:/.)?", r"/api/shutdown(?:/…
agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable
影響: go:github.com/envoyproxy/ai-gateway >= 0.4.0-rc1, < 1.2.0-rc1 → 1.2.0-rc1 The MCP proxy's client-facing session ID embeds the authenticated caller's subject (JWT sub claim) specifically as an anti-hijacking discriminator — matching the Model Context Protocol specification's documented session-hijacking guidance (https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#session-hijacking). However, the session-resume path never checks that discriminator against the current caller's identity, so any client that obtains a session ID…
Graphify Fortran extractor: incomplete cpp #include hardening allows arbitrary host-file read/exfiltration when indexing an untrusted repo
影響: pip:graphifyy >= 0.7.2, < 0.9.70 → 0.9.70 The Fortran extractor's C-preprocessor step (graphify/extractors/fortran.py, _cpp_preprocess) applies an incomplete #include hardening. The -nostdinc -I /dev/null flags it relies on (comment "Security (F-007)") do not stop a capital-F Fortran source file from including absolute paths (#include "/etc/passwd") or from path-traversing out of the corpus (#include "../../../../home/victim/.ssh/id_rsa"). cpp always searches the directory of the file being preprocessed for quoted includes and…
Mercury: Unauthenticated Remote Code Execution via /api/kernels
影響: pip:mercury <= 3.2.5 → 3.2.6 Mercury runs a JupyterLab server with anonymous access by default (mercury_app/__main__.py sets --IdentityProvider.token='' when no --token/MERCURY_TOKEN is given; when tokenless it also sets --ServerApp.disable_check_xsrf=True). It relies on a blocklist (mercury_app/block_handler.py BLOCKED_PATTERNS: /lab, /api/terminals, /api/shutdown, /files) to keep anonymous users off dangerous Jupyter endpoints. The vulnerability /api/kernels is NOT in the blocklist (and cannot be — Mercury needs kernels…
LoopX serve-status permissive CORS policy exposes control-plane state and private Markdown files
影響: pip:loopx >= 0.0.1, < 0.4.5 → 0.4.5 loopx serve-status sends Access-Control-Allow-Origin: on every response, including its unauthenticated GET routes. Because the endpoint is unauthenticated and bound to a fixed, well-known loopback port, any website the operator visits can read LoopX control-plane state and the contents of Markdown files inside every registered goal repo, using a plain fetch() with no user interaction. The write endpoints are not affected — they are correctly Origin-checked. This report is strictly about…
Get Your .NET MAUI App Ready for Xcode 27
Use an agent skill to prepare your existing .NET MAUI app for Xcode 27, with the scene lifecycle changes and manual migration steps explained. The post Get Your .NET MAUI App Ready for Xcode 27 appeared first on .NET Blog .
Bring Your Own Model to the GitHub Copilot SDK with C#
The GitHub Copilot SDK gives your application an agent runtime. BYOK lets you keep that runtime while sending model requests to your own Microsoft Foundry or Azure OpenAI deployment. Here is the complete C# setup. The post Bring Your Own Model to the GitHub Copilot SDK with C# appeared first on .NET Blog .
10월 18일 (일)
crecheck v6.0 has been released
Antananrivo, Madagascar - October 14, 2026 PostgreSQL credcheck extension The credcheck PostgreSQL extension provides few general credential checks, which will be evaluated during the user creation, during the password change and user renaming. By using this extension, we can define a set of rules: allow a specific set of credentials reject a certain type of credentials deny password that can be easily cracked enforce use of an expiration date with a minimum of day for a password define a password reuse policy define the number of authentication failure allowed before a user is banned define…
pgBackRest 2.60.0 Released
October 18, 2026 : The pgBackRest community is pleased to announce the release of pgBackRest 2.60.0, the latest version of the reliable, easy-to-use backup and restore solution that can seamlessly scale up to the largest databases and workloads. pgBackRest supports a robust set of features for managing your backup and recovery infrastructure, including: parallel backup/restore, full/differential/incremental backups, block incremental backup, multiple repositories, delta restore, parallel asynchronous archiving, malware/ransomware protection, per-file checksums, page checksums (when enabled) v…
FOSDEM PGDay 2027: two days of PostgreSQL, with calls for papers and sponsors now open!
Join us for FOSDEM PGDay 2027 on January 28 and 29 at the Brussels Marriott Hotel Grand Place . This year, we're expanding to two days, bringing you more PostgreSQL talks and more time to connect with fellow enthusiasts from around the world. Start your FOSDEM trip with dedicated PostgreSQL content, then enjoy the main FOSDEM event over the weekend! - New for 2027: sponsor the event - For the first time, we're offering sponsorship opportunities for FOSDEM PGDay! Our Platinum , Gold and Silver packages offer different ways to get involved. Platinum and Gold packages include an exhibition desk…
pg_utl_smtp v2.0 released
Antananarivo, Madagascar - October 06, 2026 PostgreSQL UTL_SMTP compatibility extension pg_utl_smtp is a PostgreSQL extension to create, manage and use Oracle-style UTL_SMTP package. The use and behavior is just like with the UTL_SMTP Oracle package. This work is released from the HexaRocket project. This extension allows email notifications to be sent from triggers or stored procedures. By integrating the extension directly into the database, you can trigger data-driven actions without waiting for application intervention. Examples include security alerts or notifications when certain minimu…
pg_hint_plan v1.9.0 Released
The pg_hint_plan development team is pleased to announce pg_hint_plan 1.9.0. This release of pg_hint_plan adds compatibility with PostgreSQL 19, and includes various improvements and bug fixes. For more details, see the release notes . This new major version includes support for path generation strategies (PGS). pg_hint_plan is a PostgreSQL extension that offers the possibility to tweak PostgreSQL execution plans using so-called "hints" in SQL comments. For more information, see the project page . The documentation of the project is published at this page , and is synced up automatically from…
10월 17일 (토)
Arcane: Delegated users:update permission allows admin account takeover via password reset (no privilege-hierarchy check)
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.6.0 → 2.6.0 A user holding the delegated users:update permission can reset the global administrator's password and take over the admin account. UpdateUser sets the target user's PasswordHash from the request body for ANY target with no comparison of caller-vs-target privilege. Because role assignment and role CRUD are deliberately gated by RequireGlobalAdmin, users:update is intended to sit BELOW admin (profile management); this finding defeats that separation. Root Cause UpdateUser (handler backen…
Arcane: Environment access token bypasses the admin-required authorization gate on `/api/debug/pprof`
影響: go:github.com/getarcaneapp/arcane/backend/v2 < 2.11.0 → 2.11.0 Arcane v2.10.2 contains an authorization inconsistency in AuthMiddleware.managerAuth. When a request supplies a valid environment access token through the X-Arcane-Agent-Token header, managerAuth resolves the associated environment, installs an environment-scoped permission set, and immediately calls next(c). This occurs before the middleware evaluates the AdminRequired option and verifies that the caller is a global administrator. As a result, an environment-scoped access token can acc…
LMCache: Remote code execution via unsafe deserialization in multiprocess mode transport
影響: pip:lmcache >= 0.3.9, < 0.5.6 → 0.5.6 LMCache is vulnerable to Unauthenticated Remote Code Execution via Pickle Deserialization on the Multiprocess ZMQ Transport Details LMCache multiprocess mode, also called distributed mode, opens an unauthenticated ZeroMQ ROUTER so worker processes can register and share KV cache blocks. The intended clients are sibling LMCache processes. There is no CURVE, ZAP, password, or message authentication on that socket. LMCache used only inside a vLLM process does not open this port. The transp…
kin-openapi openapi3filter: nil-pointer panic in ValidateResponse on a response header declared with content
影響: go:github.com/getkin/kin-openapi <= 0.145.0 → 0.146.0 ValidateResponse panics on a nil pointer when a spec declares a response header with content instead of schema. doc.Validate() accepts that document, so the crash comes from a spec the library just called valid. Same class as GHSA-jpcw-4wr7-c3vq, which covered the request-parameter case in v0.144.0; this is the response-header path. Affects github.com/getkin/kin-openapi 0 { Two things I checked rather than assumed. The response does not need to carry the header; declaring it is enough,…
Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination
影響: rust:wasmtime-wasi < 24.0.11 → 24.0.11, rust:wasmtime-wasi >= 25.0.0, < 36.0.12 → 36.0.12, rust:wasmtime-wasi >= 37.0.0, < 45.0.3 → 45.0.3, rust:wasmtime-wasi >= 46.0.0, < 46.0.1 → 46.0.1 Wasmtime's WASI filesystem implementation lets a guest with a read-only source file capability overwrite that file by hard-linking it into another preopen that allows file writes. An attacker who can run a WASI guest can bypass WasiCtxBuilder per-preopen FilePerms and modify host files that were exposed as FilePerms::READ. This attack is possible through the wasip1, wasip2, and wasip3 interfaces to the WASI filesystem. This attack is also possible through an indirection of renaming a ha…
lopdf has a stack overflow via deeply nested PDF objects
影響: rust:lopdf < 0.42.0 → 0.42.0 lopdf::Document::load_mem (and the other load entry points) parses nested PDF arrays and dictionaries with unbounded recursion. A small crafted PDF whose Catalog contains a deeply nested array (/X [[[ … ]]], on the order of 10,000 levels) exhausts the call stack and aborts the process with SIGABRT. Because this is a stack-overflow abort rather than a panic!, it cannot be caught with catch_unwind: any service that parses untrusted PDF input with lopdf can be crashed by a ~21 KB file, resulting i…
JavaCV: Integer Overflow in IPCameraFrameGrabber Causes Infinite-Loop DoS
影響: maven:org.bytedeco:javacv < 1.5.14 → 1.5.14 IPCameraFrameGrabber parses the Content-Length value from the multipart MJPEG HTTP stream returned by the configured IP camera without any bounds checking. A malicious or compromised camera endpoint - or any network attacker able to tamper with the plaintext HTTP response (these streams are conventionally accessed over http://, as documented in the class itself) - can supply a Content-Length value in the range 1073741825-2147483647. This drives the internal buffer-growth routine ensureB…
Claude Agent SDK: Argument Injection via resume Option Allows Arbitrary Command Execution
影響: pip:claude-agent-sdk < 0.2.121 → 0.2.121 The Claude Agent SDK for Python passed the resume option to the Claude CLI without validation, allowing a value beginning with - to be interpreted as a separate CLI flag. An attacker who controlled the resume value could inject an --mcp-config flag defining a stdio MCP server, resulting in arbitrary command execution at CLI startup that bypassed the SDK's permission controls. Exploitation required an application to pass untrusted input as the session ID to resume. Users are advised to update to…
MariaDB Foundation: Exploring TidesDB Performance with TAF
TidesDB now exists inside MariaDB as a pluggable storage engine. With the TideSQL plugin available, anyone can load TidesDB into a MariaDB server and begin experimenting with it. But having a plugin is only the first step — you still need a practical, reproducible way to run real workloads against it, that’s where TAF comes […] MariaDB Foundation: Exploring TidesDB Performance with TAF appeared first on MariaDB.org
CoreDNS `k8s_external` headless AXFR can emit an empty transfer batch that panics the `transfer` plugin
影響: go:github.com/coredns/coredns >= 1.9.4, <= 1.14.4 → 1.14.5 A network DNS client allowed to request AXFR for a CoreDNS zone can trigger a panic when CoreDNS is configured with k8s_external headless-service zone transfers and Kubernetes contains a headless service endpoint with no declared ports. The built-in k8s_external transferer can emit an empty []dns.RR batch, and the shared transfer plugin indexes records[0] without checking that the batch is non-empty. In normal CoreDNS mode the panic is recovered and returned as SERVFAIL, but repeated tr…
ckan-mcp-server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)
影響: npm:@aborruso/ckan-mcp-server < 0.4.112 → 0.4.112 The MCP Apps UI resource (an interactive DataStore table rendered in the host's webview/iframe) communicates with its parent via postMessage. Its inbound message listener performs no event.origin validation, and its outbound messages are sent with target origin ''. Any window/frame able to reach the document can inject data into the table and interfere with the MCP UI handshake, and the UI's own JSON-RPC messages are broadcast without an origin restriction. Affected code src/resources/d…
swoosh has email-derived URL path injection in Microsoft Graph endpoint
影響: erlang:swoosh >= 1.12.0, < 1.26.3 → 1.26.3 Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and…
ClickMigrate has Path Traversal in "revision -m" argument
影響: pip:ClickMigrate < 1.0.3 → 1.0.3 A path traversal vulnerability in the revision command allowed a crafted migration name supplied via the -m argument to escape the intended migrations directory. Under specific conditions, an attacker could cause the tool to create a .sql file in an arbitrary location writable by the user executing the command. This issue is only exploitable if an attacker can influence the migration name passed to the revision command, such as through an insecure automation or CI/CD pipeline that forwar…
gomarkdown/markdown IsSafeURL panics on short URLs
影響: go:github.com/gomarkdown/markdown < 0.0.0-20260724235538-61af6e1e6971 → 0.0.0-20260724235538-61af6e1e6971 IsSafeURL slices url[:nPath] before checking that len(url) >= nPath, so a URL shorter than a path prefix (0, 1 or 2 bytes) triggers a slice-bounds panic, and this is reached end to end when the html.Safelink hardening flag is enabled and the input contains an empty or very short link destination, giving an unrecoverable crash DoS. Confirmed at HEAD (e08cff8; present since 2022). The defect parser/parser.go, IsSafeURL: go func IsSafeURL(url []byte) bool { nLink := len(url) for _, path :=…
Improving navigation experience in v0 with Next.js 16.4
How we used Partial Prefetching and a coding agent to improve navigation across v0 with Next.js 16.4.
10월 16일 (금)
Interactive refactoring in gopls
Introducing interactive refactoring in gopls and the LSP: a new capability that brings dynamic, multi-step refactorings into your favorite editor.
Faster blank? checks, safer SQLite rollbacks, and more!
Hi, it’s Vipul. Let’s explore this week’s changes in the Rails codebase.
[悪用確認] CVE-2025-61624: Fortinet Multiple Products Path Traversal Vulnerability
Fortinet Multiple Products FortiOS, FortiPAM, FortiProxy, and FortiSwitchManager contain a path traversal vulnerability that may allow an authenticated attacker with admin profile and at least read-write permissions to write or delete arbitrary files via specific CLI commands. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-19)
[悪用確認] CVE-2026-102764: BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability
BeyondTrust Remote Support BeyondTrust Remote Support contains an authentication bypass by spoofing vulnerability that could allow a remote attacker to perform file operations on the appliance. 対応: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. (期限 2026-10-19)
TanStack Router: Unauthenticated reflected XSS in TanStack Start server-function responses
影響: npm:@tanstack/start-server-core >= 1.143.12, < 1.169.39 → 1.169.39, npm:@tanstack/react-start >= 1.143.12, < 1.168.60 → 1.168.60, npm:@tanstack/solid-start >= 1.143.12, < 1.168.57 → 1.168.57, npm:@tanstack/vue-start >= 1.143.12, < 1.168.56 → 1.168.56 An unauthenticated attacker can craft a URL to a server function in an affected TanStack Start app. If someone opens the link, the app can return attacker-controlled HTML from its own origin and run the attacker's JavaScript there. The script can access same-origin data available to that visitor and make requests with their authority. Cause The server-function transport can pass request payload fields into internal middleware state instead of limiting them to public input fields. A malfo…
Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation
影響: pip:pipecat-ai >= 0.0.98, <= 1.5.0 → 1.6.0 Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is not built or supported as a production server. Exploitation therefore requires an operator to deliberately make the development runner reachable from an untrusted network, such as by setting --host 0.0…
Podman: The `podman run` command can be instructed to disable almost all sandboxing by image annotation
影響: go:github.com/containers/podman >= 4.4.0, < 5.8.8 → 5.8.8, go:go.podman.io/podman/v6 >= 6.0.0, < 6.1.3 → 6.1.3 Podman v4.4.0 added a feature where container checkpoints (from the podman container checkpoint command) could be distributed via OCI registry, and pulled from that registry and run via the podman run command. This allowed easy transfer of checkpoints between systems. However, checkpoints allow complete control of how the container is created - including full control of the container sandbox. When podman run detects a checkpoint, it will silently ignore all user input regarding how the c…
JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked
影響: pip:jupyterlab >= 4.6.0, <= 4.6.3 → 4.6.4, pip:jupyterlab >= 4.5.7, <= 4.5.10 → 4.5.11, pip:notebook >= 7.5.6, <= 7.6.2 → 7.6.3, pip:jupyterlite-core >= 0.7.5, <= 0.8.3 → 0.8.4 A Markdown file or a notebook output can carry a button that runs a JupyterLab command. Since 4.5.7 the first click on such a button opens a prompt naming the command, with Cancel, Run Once and Trust. Choosing Trust runs the command and marks the document trusted, so its later buttons run without a prompt. Which document gets marked is decided when the user answers, not when they click. Both trust commands read whichever document is current at that moment: markdownviewer:trust uses…
SFTPGo source-side file-pattern filter bypass during copy operations
影響: go:github.com/drakkan/sftpgo/v2 >= 2.5.0, <= 2.7.5 → 2.7.6 File pattern filters (denied_patterns / allowed_patterns) were evaluated on the destination of a copy only. A user holding the copy permission could copy a file denied by the filters to a permitted name and then read it. A recursive directory copy reproduced the contents of a restricted directory under a path where the filters do not deny them, and the hide policy was affected in the same way: a file reported as missing by stat and by directory listings could still be copied. Details An…
Claude Code: Plugin Hash Pin Bypass Allows Bypass of Hash Pinning
影響: npm:@anthropic-ai/claude-code < 2.1.179 → 2.1.179 The plugin install flow in Claude Code and Claude Desktop checked out a marketplace's pinned commit SHA using git checkout without verifying that the resulting HEAD matched the pinned SHA. An attacker controlling a plugin's upstream repository could create a branch named identically to the pinned 40-character SHA, causing the checkout to silently resolve to the attacker's branch tip instead of the reviewed commit, resulting in attacker-controlled code being installed bypassing the pinned hash.…
containerd: Unpack DoS via repeated opaque whiteouts
影響: go:github.com/containerd/containerd/v2 < 2.0.12 → 2.0.12, go:github.com/containerd/containerd < 1.7.35 → 1.7.35, go:github.com/containerd/containerd/v2 >= 2.2.0, < 2.2.8 → 2.2.8, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.5 → 2.3.5 A vulnerability exists in containerd's layer unpack handler where the processing of certain image layers causes superlinear time complexity. During the unpack operation, specific file configurations within the layer can trigger repeated directory traversals. Consequently, pulling or importing a maliciously crafted image can result in increased unpack times and a moderate increase in CPU usage. This delays container startup, even if the compressed image layers are small. Additionally, in…
Distribution: Client `manifests.Get()` does not verify returned content against requested digest
影響: go:github.com/docker/distribution <= 2.8.3, go:github.com/distribution/distribution/v3 < 3.1.2 → 3.1.2 registry/client.(manifests).Get(ctx, dgst, …) fetches a manifest by digest but never hashes the returned body and compares it against the requested digest. A malicious or compromised registry, or any MITM on the registry connection, can serve arbitrary manifest bytes in response to a digest-pinned request and the client returns the substituted content transparently to the caller. Any application relying on digest pinning for supply-chain integrity — image policy controllers, mirrors, pu…
Qwik: Crashing any Qwik Server via Resource thenable
影響: npm:@builder.io/qwik < 1.20.0 → 1.20.0, npm:@qwik.dev/core < 2.0.0-beta37 → 2.0.0-beta37 A Qwik server in the default configuration can be crashed with one unauthenticated HTTP request. During qwik-json body parsing, ResourceSerializer.$fill$ does Promise.resolve(resource._resolved). If _resolved is a plain object whose .then is a QRL for an unregistered symbol, the async QRL rejects, the rejection is orphaned, and Node terminates the process via its default unhandled-rejection policy. Impact One unauthenticated request crashes the server. Looping keeps every replica dead a…
containerd CRI plugin: Checkpoint restore bypasses destination security context
影響: go:github.com/containerd/containerd/v2 >= 2.1.0, < 2.2.7 → 2.2.7, go:github.com/containerd/containerd/v2 >= 2.3.0, < 2.3.4 → 2.3.4 A vulnerability in containerd's CRI implementation allows a container restored from an untrusted checkpoint via the CreateContainer API to bypass the destination security context and execute with elevated privileges. When restoring a container from a checkpoint archive or annotated OCI image, CRIU restores process credentials, Linux capabilities, no_new_privs, and seccomp state directly from checkpoint data rather than enforcing the destination CRI ContainerConfig. An attacker who can ru…