CVE Vulnerability Catalog

A heap-based buffer overflow in H5VM_array_fill() in src/H5VM.c in HDF5 before 2.2.0. A crafted HDF5 file can cause an application crash and possibly execute arbitrary code when unallocated chunks of a dataset are read and metadata is inconsistent with the buffer's allocated size.

Backstage before version 0.17.8 in the @backstage/backend-defaults package has improper input validation in cloud storage url readers. An attacker with write access to a cloud storage bucket used by Backstage could craft object names that could collide with protected files in the output directory. In certain deployment configurations, this could lead to content injection.

Cloud storage catalog providers in Backstage before 1.54.6 did not sufficiently validate object paths. A principal able to create or rename objects in a configured Azure Blob Storage or AWS S3 catalog source could cause catalog descriptors to be read from outside the intended storage boundary, limited to locations reachable with the backend's configured credentials.

The @backstage/backend-defaults package before versions 0.16.1 and 0.17.8 improperly preserves access restrictions during service credential delegation. An external service credential configured with access restrictions (e.g., read-only) could bypass those restrictions by routing requests through plugin delegation paths.

Backstage before version 0.6.17 in the @backstage/plugin-proxy-backend package has improper input validation in proxy-backend. An authenticated Backstage user could craft a request URL that causes the proxy-backend to forward the request to a path outside the configured base path on the target server. This is limited to target servers already configured as proxy endpoints and requires Backstage authentication by default.

Backstage before version 2.2.4 in the @backstage/plugin-techdocs-backend package has improper input validation in techdocs static content requests. When using the Azure Blob Storage provider, an authenticated Backstage user may be able to read restricted TechDocs content when entity-level permissions are enabled. Deployments that intentionally disable the default backend authentication policy may have broader exposure.

Backstage before version 2.2.4 in the @backstage/plugin-techdocs-backend package has improper authorization enforcement for techdocs static content. An authenticated user with access to one TechDocs documentation site could craft a URL able to read documentation belonging to a different entity. This only affects deployments using the external TechDocs builder with an external storage provider (S3, GCS, etc.) and the permission framework enabled. Instances that do not use the permission framework are unaffected, since TechDocs content is visible to all authenticated users by design.

The @backstage/plugin-auth-backend-module-oidc-provider package before version 0.4.20 has improper authentication in the OIDC provider. Deployments using OIDC email-based identity resolution with a provider that permits unverified email addresses may allow an authenticated provider user to assume another catalog identity.

The @backstage/plugin-kubernetes-backend package in Backstage before 0.21.10 is affected by an unsupported catalog cluster authentication mode in the Kubernetes backend. Deployments using catalog cluster discovery may be affected when catalog contributors can create or modify kubernetes-cluster Resource entities. With the required endpoint permissions and pod RBAC, the backend can use its local in-cluster identity, potentially exposing Kubernetes resources readable by that identity. The credential is used only with the local in-cluster API endpoint and is not sent to the catalog-supplied endpoint.

The @backstage/plugin-scaffolder-backend-module-bitbucket-cloud before 0.3.10 and @backstage/plugin-scaffolder-backend-module-bitbucket-server before 0.2.25 do not sufficiently validate filesystem paths in Bitbucket pull-request Scaffolder actions. An authenticated user who can execute an eligible template and influence an allowed Bitbucket repository could affect paths outside the expected working area.

Backstage before version 0.8.7 in the @backstage/plugin-catalog-backend-module-gitlab package has improper authorization in gitlab organizational user ingestion. Deployments that enable GitLab organization event ingestion and rely on scoped catalog users as an access boundary may admit an unintended catalog identity. Depending on sign-in and permission configuration, this may allow unauthorized access with the permissions of a standard authenticated user.

Backstage prior to 1.54.6 does not consistently enforce credential boundaries in scaffolder source-control actions. An authenticated user could cause an affected action to fall back to broader integration credentials and perform operations with more access than intended. This issue is fixed in 1.54.6 when operators also enable scaffolder.requireScmUserCredentials after upgrading.

In @backstage/plugin-scaffolder-backend prior to 4.1.0, incorrect authorization in scaffolder task listing allows an authenticated internal user to view metadata for tasks outside the intended visibility. Stored task secrets are not included, and no integrity or availability impact was identified. Fixed in version 4.1.0.

In @backstage/plugin-auth-node from 0.3.0 to 0.6.15 and 0.7.5, explicit negative email verification was not consistently honored during shared OAuth profile normalization. In affected configurations, a user may assume another catalog identity and obtain its associated access and permissions. Fixed in versions 0.6.15 and 0.7.5.

The @backstage/plugin-scaffolder-backend-module-sentry package from 0.3.0 until 0.3.8 has improper input validation in Sentry scaffolder actions. An authenticated internal user who can execute the affected actions may cause the backend to contact unintended destinations and disclose Sentry integration credentials.

In @backstage/plugin-catalog-backend-module-bitbucket-server from 0.4.0 to 0.5.15, inconsistent repository filtering in Bitbucket Server catalog event updates may allow ingestion of locations from repositories excluded by filters. Fixed in version 0.5.15.

In @backstage/plugin-auth-backend-module-cloudflare-access-provider from 0.1.0 to 0.5.0, insufficient audience validation in the Cloudflare Access auth provider allows a user with a valid token for another Access application to authenticate to Backstage. Fixed in version 0.5.0.

In @backstage/plugin-proxy-backend from 0.5.0 to 0.6.18, inconsistent credential enforcement for overlapping proxy routes allows an unauthenticated caller to reach a nested upstream. Fixed in version 0.6.18.

The @backstage/plugin-techdocs-node package from 0.11.12 until 1.14.7 and 1.15.5 has improper validation of mkdocs plugin configuration in TechDocs. An authenticated attacker with control over a TechDocs source repository could cause a documentation build to retrieve and publish data from network locations reachable by the build environment.

A heap-based buffer overflow exists in GIMP's DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can overflow 32-bit arithmetic, causing the allocated buffer to be too small for the pixel data written through GEGL. This may lead to heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.