Advisories for Golang/Github.com/Ellanetworks/Core package

Ella Core panics when processing a NGAP handover failure message.

The PUT /api/v1/subscriber/{imsi} API accepts an IMSI identifier from both the URL path and the JSON request body but never verifies they match. This allows an authenticated NetworkManager to modify any subscriber's policy while the audit trail records a fabricated or unrelated subscriber IMSI.

Ella Core panics when processing a specially crafted NGAP LocationReport message.

Ella Core panics when processing Authentication Response and Authentication Failure NAS message missing IEs.

The NetworkManager role was granted backup and restore permission. The restore endpoint accepted any valid SQLite file without verifying its contents.

A deadlock in the AMF's SCTP notification handler causes the entire AMF control plane to hang until the process is restarted.

Ella Core panics when processing malformed UL NAS Transport NAS messages without a Request Type.

Ella Core panics when processing a malformed NGAP LocationReport message with ue-presence-in-area-of-interest event type and omitting the optional UEPresenceInAreaOfInterestList IE.

Ella Core panics when processing NGAP messages with invalid PDU Session IDs outside of 1-15.

Ella Core panics when processing a PathSwitchRequest containing UE Security Capabilities with zero-length NR encryption or integrity protection algorithm bitstrings, resulting in a denial of service.

Ella Core panics when processing a malformed integrity protected NGAP/NAS message with a length under 7 bytes.