CWE-403
Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
Monthly
Submission-login process crashes with an epoll() panic in OX Dovecot Pro and CE when the per-IP connection limit (mail_max_userip_connections, default 10) is reached, due to improper file descriptor handling (CWE-403). In high-performance mode - the default for Pro releases - the crash terminates all connections managed by the affected process, not just the triggering one, creating a broader denial-of-service for email submission. A secondary side effect of duplicate message delivery is possible when backend TLS is absent. No public exploits are known and this vulnerability is not listed in CISA KEV.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
XML External Entity (XXE) injection in Pachno 1.0.6's TextParser helper allows remote unauthenticated attackers to read arbitrary files from the server. The vulnerability is triggered through malicious XML entities embedded in wiki table syntax and inline tags within issue descriptions, comments, or wiki articles, exploiting unsafe simplexml_load_string() calls without LIBXML_NONET protections. With CVSS 9.3 and EPSS 0.04% (14th percentile), this represents a high-severity but low-probability threat. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Alpine Linux: runc fixed in 1.1.12-r0
Submission-login process crashes with an epoll() panic in OX Dovecot Pro and CE when the per-IP connection limit (mail_max_userip_connections, default 10) is reached, due to improper file descriptor handling (CWE-403). In high-performance mode - the default for Pro releases - the crash terminates all connections managed by the affected process, not just the triggering one, creating a broader denial-of-service for email submission. A secondary side effect of duplicate message delivery is possible when backend TLS is absent. No public exploits are known and this vulnerability is not listed in CISA KEV.
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4 arises from the linux_sockets module exposing an unsecured internal connection. An attacker who already holds low-level code execution on the host can leverage this leaked/unprotected socket to run arbitrary commands as root. No public exploit has been identified at time of analysis and the flaw is not in CISA KEV, so exploitation would require an existing foothold rather than remote unauthenticated access.
XML External Entity (XXE) injection in Pachno 1.0.6's TextParser helper allows remote unauthenticated attackers to read arbitrary files from the server. The vulnerability is triggered through malicious XML entities embedded in wiki table syntax and inline tags within issue descriptions, comments, or wiki articles, exploiting unsafe simplexml_load_string() calls without LIBXML_NONET protections. With CVSS 9.3 and EPSS 0.04% (14th percentile), this represents a high-severity but low-probability threat. No active exploitation (CISA KEV) or public exploit code has been identified at time of analysis.
Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Alpine Linux: runc fixed in 1.1.12-r0