CVE Vulnerability Catalog

Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow remote actors to achieve code execution in the target SageMaker execution environment and obtain IAM credentials via pre-creation of a predictably named S3 bucket that the SDK uses without ownership validation.

Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin response is being reparsed from a reentrant write-ready callback, a timing-dependent race introduced by the CVE-2021-32564 flow-control backports. This issue affects Apache Traffic Server: 9.2.15, 10.1.4, 10.2.0.

Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until the connection times out, because it waits for the trailer bytes it has already dropped. Trailer dropping is on by default in 10.x. In 8.1.11 and 9.2.x it is off by default, and those versions are affected only if it is enabled. This issue affects Apache Traffic Server: 8.1.11, from 9.2.5 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0.

Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's verify_client STRICT policy. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a transaction configured to present a different one. This affects versions 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own credentials. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. Affects versions 8.0.0–8.1.11, 9.0.0–9.2.15, 10.0.0–10.1.4, and 10.2.0.

Apache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request carrying many such headers makes the proxy write far more log data than the request contains.

Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding headers. This affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache Traffic Server from 8.0.0 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, and 10.2.0. Users are recommended to upgrade to version 9.2.16, 10.1.5, or 10.2.1, which fix the issue.

Apache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects versions 8.0.0 through 8.1.11, 9.0.0 through 9.2.15, 10.0.0 through 10.1.4, and 10.2.0.

The MCTP-over-I2C+GPIO target binding (mctp_i2c_gpio_target.c) fails to clear the selected register (b->reg_addr) and data-phase flag (b->rxtx) on I2C STOP. A bus controller can use two ordinary transactions to make mctp_bus_rx() run with a NULL buffer or to dereference b->tx_pkt->end after it was cleared, triggering an exception in the I2C target interrupt handler and a device reset or halt.

The Nuvoton NPCX eSPI driver's espi_taf_parse() processes TAF requests without validating the 12-bit length field from the request header. For write and RPMC OP1 requests it copies up to 255 words into a fixed 16-word buffer in a static structure, causing an out-of-bounds write of roughly 956 bytes into .bss and reads past neighbouring eSPI registers. The same unvalidated length is passed to flash_write(), letting the host read up to 4 KB of adjacent controller SRAM.

A race condition in the Zephyr kernel affects z_waitq_head(), which on SMP systems reads the head of a thread wait queue without holding the _sched_spinlock. The race between timer expiration handling and thread abort can cause out-of-bounds and use-after-free writes in supervisor context plus scheduler state corruption.

The Infineon PSOC 6 BLESS HCI driver stored the outgoing HCI packet descriptor in a file-scope variable shared across threads, while the serialising semaphore protected only the call into the controller, not the shared state that call reads. Concurrent transmissions from different threads can cause the controller to receive a descriptor with mismatched fields (dataLength from one buffer, data pointer from another), leading to disclosure of adjacent RAM or loss/duplication of HCI packets.

The Broadcom AFBR-S50 time-of-flight sensor driver in Zephyr RTOS double-completes an RTIO submission when sensor data evaluation fails. The error branch in data_ready_work_handler() calls handle_error_on_result() but does not return, so the same struct rtio_iodev_sqe is finalised a second time via rtio_iodev_sqe_ok(). This causes use-after-free, double-free of the pool entry, and writes through a released buffer.

A vulnerability in the Zephyr device multiplexer pseudo-driver (devmux) is caused by missing permission validation in the syscall verifiers for user-mode callers. With CONFIG_USERSPACE and CONFIG_DEVMUX enabled, a user thread can read and change the multiplexer's downstream device selection without authorization, because devmux devices are not registered as kernel objects and cannot be subject to access control.

A vulnerability in the user-mode verifier for the peci_transfer() system call in Zephyr RTOS. The z_vrfy_peci_transfer() function only checked device object permission and copied the caller-supplied peci_msg structure without validating the buf pointers and len values inside the embedded tx_buffer and rx_buffer structures, which were passed unchecked to the driver. This allows a user with access to the PECI device to perform arbitrary kernel writes, kernel reads, and trigger a supervisor-mode fault.

A vulnerability in the Bluetooth Classic A2DP host stack (Zephyr) involves struct bt_a2dp_codec_ie, which stores a one-byte len field plus a fixed 8-byte codec_ie[] array. When an AVDTP peer sends a codec IE longer than 8 bytes, a2dp_process_config_ind(), bt_a2dp_get_config_cb() and bt_a2dp_set_config_cb() copy only the first 8 bytes but keep the full attacker-chosen length in len. Later consumers trust len, leading to an out-of-bounds read and disclosure of adjacent RAM to a paired BR/EDR peer.

A vulnerability was detected in HarnessRouter up to 0.31.10 in the file gateway/app.py of the Identity Mode component. Manipulating the X-Harness-Org/X-Harness-Member arguments results in improper authorization. The attack is remotely possible, with high complexity and difficult exploitability.