From 0103b27bf9ab8535e977968281abed1ae33783bf Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 23 Jan 2024 20:11:10 +0000 Subject: [PATCH] Publish Advisories GHSA-2jxw-4hm4-6w87 GHSA-32q4-86g8-6637 GHSA-7q8p-9953-pxvr GHSA-c8v3-jhv9-4ppc GHSA-j3m6-gvm8-mhvw GHSA-2jxw-4hm4-6w87 --- .../GHSA-2jxw-4hm4-6w87.json | 62 ++++++++++++ .../GHSA-32q4-86g8-6637.json | 27 +++++- .../GHSA-7q8p-9953-pxvr.json | 69 +++++++++++++ .../GHSA-c8v3-jhv9-4ppc.json | 67 +++++++++++++ .../GHSA-j3m6-gvm8-mhvw.json | 96 +++++++++++++++++++ .../GHSA-2jxw-4hm4-6w87.json | 35 ------- 6 files changed, 317 insertions(+), 39 deletions(-) create mode 100644 advisories/github-reviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json rename advisories/{unreviewed => github-reviewed}/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json (64%) create mode 100644 advisories/github-reviewed/2024/01/GHSA-7q8p-9953-pxvr/GHSA-7q8p-9953-pxvr.json create mode 100644 advisories/github-reviewed/2024/01/GHSA-c8v3-jhv9-4ppc/GHSA-c8v3-jhv9-4ppc.json create mode 100644 advisories/github-reviewed/2024/01/GHSA-j3m6-gvm8-mhvw/GHSA-j3m6-gvm8-mhvw.json delete mode 100644 advisories/unreviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json diff --git a/advisories/github-reviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json b/advisories/github-reviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json new file mode 100644 index 00000000000..eefed4d4895 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json @@ -0,0 +1,62 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-2jxw-4hm4-6w87", + "modified": "2024-01-23T20:10:02Z", + "published": "2024-01-22T03:30:26Z", + "aliases": [ + "CVE-2024-23751" + ], + "summary": "SQL injection in llama-index", + "details": "LlamaIndex (aka llama_index) through 0.9.35 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via \"Drop the Students table\" within English language input.", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "PyPI", + "name": "llama-index" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "0.9.35" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23751" + }, + { + "type": "WEB", + "url": "https://github.com/run-llama/llama_index/issues/9957" + }, + { + "type": "WEB", + "url": "https://github.com/pypa/advisory-database/tree/main/vulns/llama-index/PYSEC-2024-12.yaml" + }, + { + "type": "PACKAGE", + "url": "https://github.com/run-llama/llama_index" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-89" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:10:02Z", + "nvd_published_at": "2024-01-22T01:15:08Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json b/advisories/github-reviewed/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json similarity index 64% rename from advisories/unreviewed/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json rename to advisories/github-reviewed/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json index f3e81408be9..b3643f9f8ad 100644 --- a/advisories/unreviewed/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json +++ b/advisories/github-reviewed/2024/01/GHSA-32q4-86g8-6637/GHSA-32q4-86g8-6637.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-32q4-86g8-6637", - "modified": "2024-01-23T15:30:57Z", + "modified": "2024-01-23T20:10:32Z", "published": "2024-01-16T21:31:22Z", "aliases": [ "CVE-2024-22491" ], + "summary": "Stored Cross Site Scripting in beetl-bbs", "details": "A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameter.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Maven", + "name": "com.ibeetl:beetl" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "2.0.0" + } + ] + } + ] + } ], "references": [ { @@ -31,8 +50,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:10:32Z", "nvd_published_at": "2024-01-16T19:15:09Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-7q8p-9953-pxvr/GHSA-7q8p-9953-pxvr.json b/advisories/github-reviewed/2024/01/GHSA-7q8p-9953-pxvr/GHSA-7q8p-9953-pxvr.json new file mode 100644 index 00000000000..54247b2359d --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-7q8p-9953-pxvr/GHSA-7q8p-9953-pxvr.json @@ -0,0 +1,69 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-7q8p-9953-pxvr", + "modified": "2024-01-23T20:10:20Z", + "published": "2024-01-23T20:10:20Z", + "aliases": [ + "CVE-2024-23636" + ], + "summary": "Remote Command Execution in SOFARPC", + "details": "Impact\nSOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection. But there is a gadget chain that can bypass the SOFA Hessian blacklist protection mechanism, and this gadget chain only relies on JDK and does not rely on any third-party components.\n\nPatches\nFixed this issue by adding a blacklist, users can upgrade to sofarpc version 5.12.0 to avoid this issue.\n\nWorkarounds\nSOFARPC also provides a way to add additional blacklist. Users can add some class like -Drpc_serialize_blacklist_override=org.apache.xpath. to avoid this issue.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "com.alipay.sofa:rpc-sofa-boot-starter" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "5.12.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/sofastack/sofa-rpc/security/advisories/GHSA-7q8p-9953-pxvr" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23636" + }, + { + "type": "WEB", + "url": "https://github.com/sofastack/sofa-rpc/commit/42d19b1b1d14a25aafd9ef7c219c04a19f90fc76" + }, + { + "type": "WEB", + "url": "https://github.com/sofastack/sofa-rpc/commit/d08e25824ae9feaf0876adba9acd2938f34759b1" + }, + { + "type": "PACKAGE", + "url": "https://github.com/sofastack/sofa-rpc" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-502" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:10:20Z", + "nvd_published_at": "2024-01-23T18:15:19Z" + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-c8v3-jhv9-4ppc/GHSA-c8v3-jhv9-4ppc.json b/advisories/github-reviewed/2024/01/GHSA-c8v3-jhv9-4ppc/GHSA-c8v3-jhv9-4ppc.json new file mode 100644 index 00000000000..278bfa606ba --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-c8v3-jhv9-4ppc/GHSA-c8v3-jhv9-4ppc.json @@ -0,0 +1,67 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-c8v3-jhv9-4ppc", + "modified": "2024-01-23T20:10:48Z", + "published": "2024-01-23T20:10:48Z", + "aliases": [ + + ], + "summary": "Use-after-free when setting the locale", + "details": "Version 3.0.0 introduced an `AtomicStr` type, that is used to store the current locale. It stores the locale as a raw pointer to an `Arc`. The locale can be read with `AtomicStr::as_str()`. `AtomicStr::as_str()` does not increment the usage counter of the `Arc`.\n\nIf the locale is changed in one thread, another thread can have a stale -- possibly already freed -- reference to the stored string.\n", + "severity": [ + + ], + "affected": [ + { + "package": { + "ecosystem": "crates.io", + "name": "rust-i18n-support" + }, + "ecosystem_specific": { + "affected_functions": [ + "rust_i18n_support::AtomicStr::as_str" + ] + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "3.0.0" + }, + { + "fixed": "3.0.1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/longbridgeapp/rust-i18n/issues/71" + }, + { + "type": "WEB", + "url": "https://github.com/longbridgeapp/rust-i18n/commit/22e0609591a2c08930f52a0e6bc860f02a0e88c0" + }, + { + "type": "PACKAGE", + "url": "https://github.com/longbridgeapp/rust-i18n" + }, + { + "type": "WEB", + "url": "https://rustsec.org/advisories/RUSTSEC-2024-0007.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-416" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:10:48Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2024/01/GHSA-j3m6-gvm8-mhvw/GHSA-j3m6-gvm8-mhvw.json b/advisories/github-reviewed/2024/01/GHSA-j3m6-gvm8-mhvw/GHSA-j3m6-gvm8-mhvw.json new file mode 100644 index 00000000000..16c796ae555 --- /dev/null +++ b/advisories/github-reviewed/2024/01/GHSA-j3m6-gvm8-mhvw/GHSA-j3m6-gvm8-mhvw.json @@ -0,0 +1,96 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-j3m6-gvm8-mhvw", + "modified": "2024-01-23T20:09:52Z", + "published": "2024-01-23T20:09:52Z", + "aliases": [ + "CVE-2023-49783" + ], + "summary": "No permission checks for editing/deleting records with CSV import form", + "details": "### Impact\nUsers who don't have edit or delete permissions for records exposed in a `ModelAdmin` can still edit or delete records using the CSV import form, provided they have create permissions.\n\nThe likelyhood of a user having create permissions but _not_ having edit or delete permissions is low, but it _is_ possible.\n\nNote that this doesn't affect any `ModelAdmin` which has had the import form disabled via the [`showImportForm` public property](https://api.silverstripe.org/4/SilverStripe/Admin/ModelAdmin.html#property_showImportForm), nor does it impact the `SecurityAdmin` section.\n\n#### Action may be required\n\nIf you have a custom implementation of [`BulkLoader`](https://api.silverstripe.org/4/SilverStripe/Dev/BulkLoader.html), you should update your implementation to respect permissions when the return value of [`getCheckPermissions()`](https://api.silverstripe.org/4/SilverStripe/Dev/BulkLoader.html#method_getCheckPermissions) is true.\n\nIf you are using any `BulkLoader` in your own project logic, or maintain a module which uses it, you should consider passing `true` to [`setCheckPermissions()`](https://api.silverstripe.org/4/SilverStripe/Dev/BulkLoader.html#method_setCheckPermissions) if the data is provided by users.\n\n### References\n- https://www.silverstripe.org/download/security-releases/CVE-2023-49783\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "silverstripe/admin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "1.0.0" + }, + { + "fixed": "1.13.19" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "silverstripe/admin" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.1.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/silverstripe/silverstripe-admin/security/advisories/GHSA-j3m6-gvm8-mhvw" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49783" + }, + { + "type": "WEB", + "url": "https://github.com/silverstripe-security/security-issues/issues/177" + }, + { + "type": "WEB", + "url": "https://github.com/silverstripeltd/product-issues/issues/832" + }, + { + "type": "WEB", + "url": "https://github.com/silverstripe/silverstripe-admin/commit/9693130a0a637cdf512277cf5f07e83250b191db" + }, + { + "type": "PACKAGE", + "url": "https://github.com/silverstripe/silverstripe-admin" + }, + { + "type": "WEB", + "url": "https://www.silverstripe.org/download/security-releases/CVE-2023-49783" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-863" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2024-01-23T20:09:52Z", + "nvd_published_at": "2024-01-23T14:15:37Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json b/advisories/unreviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json deleted file mode 100644 index 883be4efcdf..00000000000 --- a/advisories/unreviewed/2024/01/GHSA-2jxw-4hm4-6w87/GHSA-2jxw-4hm4-6w87.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-2jxw-4hm4-6w87", - "modified": "2024-01-22T03:30:26Z", - "published": "2024-01-22T03:30:26Z", - "aliases": [ - "CVE-2024-23751" - ], - "details": "LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQueryEngine, NLSQLRetriever, RetrieverQueryEngine, and PGVectorSQLQueryEngine. For example, an attacker might be able to delete this year's student records via \"Drop the Students table\" within English language input.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-23751" - }, - { - "type": "WEB", - "url": "https://github.com/run-llama/llama_index/issues/9957" - } - ], - "database_specific": { - "cwe_ids": [ - - ], - "severity": null, - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2024-01-22T01:15:08Z" - } -} \ No newline at end of file