Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21448-1

Опубликовано: 27 июл. 2026
Источник: suse-cvrf

Описание

Security update for agama-web-ui

This update for agama-web-ui fixes the following issues:

  • CVE-2025-7783: form-data: unsafe Math.random() function is used to select a boundary value for multipart form-encoded data (bsc#1246822).
  • CVE-2026-12143: form-data: CRLF injection via unescaped multipart field names and filenames (bsc#1272310).
  • CVE-2026-13149: brace-expansion: expand() function exhibits exponential-time complexity when processing non-expanding {} brace groups (bsc#1269927).
  • CVE-2026-13311: shell-quote: quadratic complexity in parse() function when processing specially crafted strings (bsc#1269359).
  • CVE-2026-13676: fast-uri: host-based policy bypass due to failure to canonicalize Unicode/IDN hostnames for HTTP-family URLs (bsc#1269595).
  • CVE-2026-27601: underscore: DoS via stack overflow due to missing depth limits in _.flatten and _.isEqual functions (bsc#1259169).
  • CVE-2026-40181: react-router: open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs (bsc#1272311).
  • CVE-2026-49356: @babel/core: arbitrary file read via sourceMappingURL comment (bsc#1272317).
  • CVE-2026-53550: js-yaml: quadratic complexity in merge-key processing when processing a crafted YAML document (bsc#1268851).
  • CVE-2026-53632: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows (bsc#1272319).
  • CVE-2026-54466: websocket-driver: message corruption via abuse of protocol length headers (bsc#1272312).
  • CVE-2026-54490: websocket-driver: resource limit bypass via message compression (bsc#1272313).
  • CVE-2026-55602: http-proxy-middleware: Host-header-driven backend routing bypass via router host+path substring matching (bsc#1272318).

Список пакетов

openSUSE Leap 16.0
agama-web-ui-17+673.b97ba64d6-160000.12.1

Ссылки

Описание

Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js. This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the attacker to terminate the header line and inject additional headers, or to smuggle entire additional multipart parts, into the request the application forwards to a backend. This can let the attacker add or override form fields (e.g. set `is_admin=true`) seen by the downstream parser. This is an instance of CWE-93 (CRLF injection). The fix escapes CR, LF, and `"` as `%0D`, `%0A`, and `%22` in field names and filenames, matching the serialization browsers use per the WHATWG HTML multipart/form-data encoding algorithm. Exploitation requires the consuming application to use untrusted input as a field name or filename; applications that use only fixed/trusted field names are not affected. Fixed in 2.5.6, 3.0.5, and 4.0.6.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

brace-expansion through 5.0.6 is vulnerable to denial of service. The expand() function exhibits exponential-time complexity in the number of consecutive non-expanding '{}' brace groups. An attacker who passes a crafted string to expand(), directly or transitively, can cause significant CPU consumption and event-loop blocking. The max option does not mitigate this, as it bounds the output size rather than the recursion work.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

shell-quote prior to 1.8.5 finalizes parsed tokens in parse() using Array.prototype.concat as a reduce accumulator, which reallocates and copies the entire growing array on every iteration. As a result parse() runs in O(n^2) time relative to the number of input tokens. An attacker who can supply an attacker-controlled string to any code path that calls parse() (no shell metacharacters are required; plain space-separated words suffice) can block the single-threaded Node.js event loop for an extended period with a small input, resulting in a denial of service. There is no code execution or data disclosure; impact is to availability only. Fixed in 1.8.5.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) before passing the same URL to Node's URL or fetch can be bypassed when the two implementations resolve the same input to different hosts. Patches: upgrade to fast-uri 3.1.3 for the 3.x line or 4.0.1 for the 4.x line. Workarounds: enforce host policy using the same URL parser used for the actual request, or reject non-ASCII hosts before policy checks.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

Underscore.js is a utility-belt library for JavaScript. Prior to 1.13.8, the _.flatten and _.isEqual functions use recursion without a depth limit. Under very specific conditions, detailed below, an attacker could exploit this in a Denial of Service (DoS) attack by triggering a stack overflow. Untrusted input must be used to create a recursive datastructure, for example using JSON.parse, with no enforced depth limit. The datastructure thus created must be passed to _.flatten or _.isEqual. In the case of _.flatten, the vulnerability can only be exploited if it is possible for a remote client to prepare a datastructure that consists of arrays at all levels AND if no finite depth limit is passed as the second argument to _.flatten. In the case of _.isEqual, the vulnerability can only be exploited if there exists a code path in which two distinct datastructures that were submitted by the same remote client are compared using _.isEqual. For example, if a client submits data that are stored in a database, and the same client can later submit another datastructure that is then compared to the data that were saved in the database previously, OR if a client submits a single request, but its data are parsed twice, creating two non-identical but equivalent datastructures that are then compared. Exceptions originating from the call to _.flatten or _.isEqual, as a result of a stack overflow, are not being caught. This vulnerability is fixed in 1.13.8.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7.0 through 6.30.3, certain URLs passed to the redirect function can trigger an open redirect to an external domain due to path values starting with // being reinterpreted as protocol-relative URLs. The level of impact depends on the validation done by the application prior to returning the redirect. This does not impact applications using Declarative Mode (<BrowserRouter>). This is patched in versions 7.14.1 and 6.30.4.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

Babel is a compiler for writing next generation JavaScript. Prior to 8.0.0-rc.6 and 7.29.6, @babel/core affected by an arbitrary file read via a sourceMappingURL comment. Using @babel/core to compile maliciously crafted code can allow an attacker to read any source map from the system that is running Babel, if the attacker controls the input source code, can read the output source code, and knows the path of the source map file that they want to read. This vulnerability is fixed in 8.0.0-rc.6 and 7.29.6.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user's NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, the frame format in draft versions of the WebSocket protocol includes a length header that allows an arbitrarily large integer to be encoded as a sequence of bytes with the high bit set. By sending an indefinite sequence of bytes with values 0x80 or above, a client can make the server parse these bytes into an ever-growing integer in lib/websocket/driver/draft75.js; because JavaScript numbers are 64-bit floating point values, this number will eventually lose precision and lead to the subsequent payload being parsed incorrectly. This issue is fixed in version 0.7.5.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.7.5, if this library is used with the permessage-deflate extension, a WebSocket server or client can be made to accept messages that are larger than the configured maximum message size because the limit is checked against the message frames' length headers, which give the size of the compressed data, not the size after decompression in lib/websocket/driver/hybi.js. This can lead to applications accepting larger messages than expected and exceeding their intended resource usage. This issue is fixed in version 0.7.5.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки

Описание

http-proxy-middleware is node.js http-proxy middleware. From 0.16.0 until 2.0.10, 3.0.6, and 4.1.0, http-proxy-middleware documents router proxy-table entries as host, path, or host+path selectors, but the host+path implementation uses unanchored substring matching on attacker-controlled request metadata. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0.

Затронутые продукты
openSUSE Leap 16.0:agama-web-ui-17+673.b97ba64d6-160000.12.1
Ссылки
Уязвимость openSUSE-SU-2026:21448-1