Vulnérabilités de la pile Python · Page n° 159

Unbounded recursion in Python Protobuf

Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can result in a Denial of service by crashing the application with a RecursionError. We recommend upgrading to version =>6.31.1 or beyond commit 17838beda2943d08b8a9d4df5b68f5f04f26d901

• Mettez à jour vers 2.6.1-1.3ubuntu0.1~esm4
• Mettez à jour vers 3.0.0-9.1ubuntu1.1+esm3
• Mettez à jour vers 3.12.4-1ubuntu7.22.04.4
• Mettez à jour vers 3.21.12-11+deb13u1
• Mettez à jour vers 3.21.12-12
• Mettez à jour vers 3.21.12-3+deb12u1
• Mettez à jour vers 3.21.12-8.2ubuntu0.2
• Mettez à jour vers 3.6.1.3-2ubuntu5.2+esm2
• Mettez à jour vers 4.25.8
• Mettez à jour vers 5.29.5
• Mettez à jour vers 6.31.1

CVE-2024-38824 salt advisory

Directory traversal vulnerability in recv_file method allows arbitrary files to be written to the master cache directory.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22242 salt advisory

Worker process denial of service through file read operation. .A vulnerability exists in the Master's “pub_ret” method which is exposed to all minions. The un-sanitized input value “jid” is used to construct a path which is then opened for reading. An attacker could exploit this vulnerabilities by attempting to read from a filename that will not return any data, e.g. by targeting a pipe node on the proc file system.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22241 salt advisory

File contents overwrite the VirtKey class is called when “on-demand pillar” data is requested and uses un-validated input to create paths to the “pki directory”. The functionality is used to auto-accept Minion authentication keys based on a pre-placed “authorization file” at a specific location and is present in the default configuration.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22240 salt advisory

Arbitrary directory creation or file deletion. In the find_file method of the GitFS class, a path is created using os.path.join using unvalidated input from the “tgt_env” variable. This can be exploited by an attacker to delete any file on the Master's process has permissions to.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22239 salt advisory

Arbitrary event injection on Salt Master. The master's "_minion_event" method can be used by and authorized minion to send arbitrary events onto the master's event bus.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22238 salt advisory

Directory traversal attack in minion file cache creation. The master's default cache is vulnerable to a directory traversal attack. Which could be leveraged to write or overwrite 'cache' files outside of the cache directory.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22237 salt advisory

An attacker with access to a minion key can exploit the 'on demand' pillar functionality with a specially crafted git url which could cause and arbitrary command to be run on the master with the same privileges as the master process.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-22236 salt advisory

Minion event bus authorization bypass. An attacker with access to a minion key can craft a message which may be able to execute a job on other minions (>= 3007.0).

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2024-38825 Salt Advisory

The salt.auth.pki module does not properly authenticate callers. The "password" field contains a public certificate which is validated against a CA certificate by the module. This is not pki authentication, as the caller does not need access to the corresponding private key for the authentication attempt to be accepted.

• Mettez à jour vers 3006.12
• Mettez à jour vers 3007.4

CVE-2025-28389

Weak password requirements in OpenC3 COSMOS v6.0.0 allow attackers to bypass authentication via a brute force attack.

CVE-2025-28388

OpenC3 COSMOS before v6.0.2 was discovered to contain hardcoded credentials for the Service Account.

CVE-2025-28386

A remote code execution (RCE) vulnerability in the Plugin Management component of OpenC3 COSMOS v6.0.0 allows attackers to execute arbitrary code via uploading a crafted .txt file.

CVE-2025-28384

An issue in the /script-api/scripts/ endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

CVE-2025-28382

An issue in the openc3-api/tables endpoint of OpenC3 COSMOS before 6.1.0 allows attackers to execute a directory traversal.

CVE-2025-28381

A credential leak in OpenC3 COSMOS before v6.0.2 allows attackers to access service credentials as environment variables stored in all containers.

CVE-2025-28380

A cross-site scripting (XSS) vulnerability in OpenC3 COSMOS before v6.0.2 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the URL parameter.

Vantage6 Server JWT secret not cryptographically secure

vantage6 is an open-source infrastructure for privacy preserving analysis. The JWT secret key in the vantage6 server is auto-generated unless defined by the user. The auto-generated key is a UUID1, which is not cryptographically secure as it is predictable to some extent. This vulnerability is fixed in 4.11.0.

• Mettez à jour vers 4.11.0

vantage6 lacks brute-force protection on change password functionality

vantage6 is an open source framework built to enable, manage and deploy privacy enhancing technologies like Federated Learning and Multi-Party Computation. If attacker gets access to an authenticated session, they can try to brute-force the user password by using the change password functionality: they can call that route infinitely which will return the message that password is wrong until it is correct. This vulnerability is fixed in 4.11.

• Mettez à jour vers 4.11.0

Nautobot may allows uploaded media files to be accessible without authentication

Nautobot is a Network Source of Truth and Network Automation Platform. Prior to v2.4.10 and v1.6.32 , files uploaded by users to Nautobot's MEDIA_ROOT directory, including DeviceType image attachments as well as images attached to a Location, Device, or Rack, are served to users via a URL endpoint that was not enforcing user authentication. As a consequence, such files can be retrieved by anonymous users who know or can guess the correct URL for a given file. Nautobot v2.4.10 and v1.6.32 address this issue by adding enforcement of Nautobot user authentication to this endpoint.

• Mettez à jour vers 1.6.32
• Mettez à jour vers 2.4.10