Free5GC udm 1.2.0 for Go any version

free5GC UDM DataChangeNotification Procedure Panic Due to Nil Pointer Dereference

free5GC UDM vulnerable to null byte injection in URL path parameters causing 500 Internal Server Error

free5GC UDM incorrectly returns 500 for empty supi path parameter in PATCH sdm-subscriptions reques

free5GC has Improper Input Validation in UDM UEAU Service

free5GC has Null Pointer Dereference in UDM, Leading to Service Panic

free5GC has Improper Error Handling in UDM, Leading to Information Exposure

pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared secret via an uncompressed public key that has not been validated. An attacker can send arbitrary SUCIs to the UDM, which tries to decrypt them via both its private key and the attacker's public key.

free5GC UDM incorrectly returns 500 for empty supi path parameter in DELETE sdm-subscriptions request

free5GC has Improper Input Validation in UDM, Leading to Information Exposure