Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

SummaryRepo under test: https://github.com/Netflix/lemurThe certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

GHSA-CFH6-PV5C-38JV Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Summary Repo under test: https://github.com/Netflix/lemur The certificate create and upload endpoints accept a replaces alias replacements array that is resolved to live Certificate ORM objects with no ownership or CertificatePermission check on the referenced certificates. The SQLAlchemy...

GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass

GStreamer webrtcbin: inverted SDP fingerprint presence check enables remote SDP authentication-binding bypass Vulnerability Overview While validating a remote SDP in the set-remote-description path, GStreamer webrtcbin's checksdpcrypto inverts the presence check for a=fingerprint attributes: an S...