CVE Vulnerability Catalog

NLnet Labs Unbound 1.12.0 up to and including 1.26.0 has a use-after-free vulnerability when compiled for DNS-over-HTTPS support with '--with-libnghttp2'. During failure code paths (e.g., RPZ drop, jostle), a dropped DoH stream brings down the whole DoH session and does not account properly for other streams, leading to use-after-free. An attacker can trigger it with a single DoH connection, but impact is limited as reads are not user controlled; however, a hardened allocator can catch the use-after-free and controllably terminate the process, causing DoS.

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability was found that can progressively corrupt heap memory and under certain systems and compilation options could lead to remote code execution. The vulnerability starts when CNAME synthesis during an upstream response needs to enforce (rewrite) a max TTL value in the packet buffer. Coupled with a compression pointer that points to the overwritten value and invalidates the domain name, it leads to an error path that does not properly move the buffer position and allows for the heap buffer overflow.

In the Apache Airflow FAB provider, resetting a user's password does not delete that user's existing database-backed sessions, despite documented behaviour. The cleanup compares a string session identifier with the user's integer database identifier, so the comparison never matches and no session is removed, leaving an attacker with a copied cookie still authenticated.

In NLnet Labs Unbound up to and including 1.26.0, a vulnerability in the DNSSEC validator enables denial of service and possible remote code execution via DNSKEY processing. A crafted DNSKEY can overflow the digest buffer.

In NLnet Labs Unbound up to and including 1.26.0, a 255 length query name with a large TCP response can lead to a heap buffer overflow during the RRSet canonicalisation routine. This is caused by missing to add the first owner name into the buffer length check. A malicious actor operating a malicious name server or tampering with an incoming response to Unbound (canonicalisation happens before DNSSEC validation) can trigger the vulnerability.

In NLnet Labs Unbound up to and including 1.26.0, a degradation of service vulnerability is present in the TCP/DoT reading procedure where there is no limit on consecutive reads. A malicious actor that can stream and sustain a rate of distinct uncached names over the TCP/DoT connection monopolizes a single worker's entire event loop for as long as its writes stay ahead of the drain.

NLnet Labs Unbound 1.22.0 up to and including 1.26.1 has a use-after-free vulnerability when compiled for DNS-over-QUIC support with '--with-libngtcp2'. Each DoQ stream owns an output buffer holding the DNS response, and ngtcp2's retransmission buffer keeps a shallow pointer into it. On client RESET_STREAM, the output buffer is freed but ngtcp2 still holds matching retransmission entries, leading to use-after-free on next PTO. An unprivileged attacker can trigger this by querying over DoQ, withholding ACKs, sending RESET_STREAM, and waiting for PTO, causing abnormal server exit.

In NLnet Labs Unbound 1.13.2 up to and including 1.26.1, in zones with ZONEMD enabled (zonemd-check: yes) located below a trust anchor, there is an attack window where tampered zone contents are served (or stored to disk) prior to the ZONEMD integrity check. This is caused by the needed DS/DNSKEY asynchronous resolution before the ZONEMD check completes. If a zonefile is written to disk while the ZONEMD check failed, the tampered data are reloaded on startup and available until ZONEMD verification concludes again.

In NLnetLabs Unbound 1.20.0 up to and including 1.26.0, a vulnerability on the 'serve-expired' code path can cause a double decrement on the 'wait-limit' counter per client IP essentially bypassing one of the counter measures that was introduced for DNSBomb (CVE-2024-33655). A malicious actor can exploit this by controlling an authoritative zone with short TTL, so cached entries expire quickly. Each 'slow' query, one the attacker's authoritative never answers, is followed by one query for an expired cached name, which is answered immediately via the 'serve-expired' path and decrements the counter twice. This second query was named 'pump'. By alternating slow queries and pumps, the attacker keeps the per-client counter at or below the configured 'wait-limit' indefinitely, and can hold an arbitrary number of pending queries from a single source IP, up to the global mesh quota (num-queries-per-thread); eventually bypassing one of the counter measures introduced for DNSBomb (CVE-2024-33655). This vulnerability is present on the 'serve-expired' code path.

On affected platforms running Arista EOS with gRPC Network Management Interface (gNMI) enabled, a specially crafted request could allow a malicious authenticated client with gNMI access to execute arbitrary code with root privileges on the switch.

On affected platforms running Arista EOS, when multiple gRPC Network Security Interface (gNSI) transports are configured, a race condition in the gNSI Authz service may cause a policy rotation to fail silently. An authenticated user whose access was revoked by the new policy may retain unauthorized access to gRPC interfaces. This does not affect Bootz. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation.

On affected EOS platforms with AAA-based gRPC authorization enabled for OpenConfig, gRPC requests of an authenticated user to OpenConfig may use the wrong privilege level, resulting in an authorization using the wrong AAA method list. This does not impact non-gRPC OpenConfig requests such as NETCONF.

On affected platforms running Arista EOS with gRPC Network Security Interface (gNSI) Credentialz configured, a specially crafted request can cause unintended modifications to the target account's properties. This may result in the account being assigned elevated privileges or access beyond what an administrator intended.

On Arista EOS platforms, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy uploaded in the ongoing RPC stream to become active. This does not affect Bootz. The issue was discovered internally by Arista, and the company is not aware of any malicious uses in customer networks.

On Arista EOS platforms with OpenConfig and a gNMI server, when gNSI Pathz is configured with a policy containing both a group rule and a user rule for the same path, gNMI may fail to enforce the policy correctly. Under certain conditions, an authenticated user may gain unauthorized read or write access to gNMI paths that the Pathz policy intended to restrict.

On Arista EOS platforms with OpenConfig-related services (gNMI, gNSI, RESTCONF, NETCONF), sensitive requests and responses may be unintentionally logged. These logs may be stored locally or sent to remote accounting servers. Examples include sensitive CLI commands and sensitive OpenConfig YANG leafs.

In affected versions of Octopus Server, a user with permission to modify non built-in external feeds could exploit a path traversal flaw to overwrite arbitrary files on the server, potentially leading to remote code execution in some configurations.

In the jwcrypto library, the JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.

A vulnerability has been identified in WTV676-HB6035 Web Interface (All versions < V3.94) and WTV776-HB6035 Web Interface (All versions < V4.17). Affected devices do not properly validate input received from backend services. This could allow an unauthenticated remote attacker to force the device into protection mode, which results in losing remote connectivity functions (Web Access).

XikeStor Layer3 switches lack authentication for downloading configuration data. An unauthenticated attacker may retrieve configuration data containing network configurations and passwords to operate the device improperly or use it as a jump host.