netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Publish Advisories

Browse Source 
GHSA-8h95-jcp5-pjpr
GHSA-8hp3-rmr7-xh88
GHSA-c7vf-m394-m4x4
GHSA-ff72-ff42-c3gw
GHSA-vj36-3ccr-6563
This commit is contained in:
advisory-database[bot]
2024-02-20 23:47:57 +00:00
parent 09145630e2
commit 01aaf1b6fe
5 changed files with 135 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/unreviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json → advisories/github-reviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8h95-jcp5-pjpr",
"modified": "2024-02-17T06:30:35Z",
"modified": "2024-02-20T23:47:20Z",
"published": "2024-02-17T06:30:34Z",
"aliases": [
"CVE-2024-21493"
],
"summary": "Improper Validation of Array Index in github.com/greenpau/caddy-security",
"details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/greenpau/caddy-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.23"
}
]
}
]
}
],
"references": [
{
@@ -32,6 +51,10 @@
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5961078"
},
{
"type": "PACKAGE",
"url": "github.com/greenpau/caddy-security"
}
],
"database_specific": {
@@ -39,8 +62,8 @@
"CWE-129"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-20T23:47:20Z",
"nvd_published_at": "2024-02-17T05:15:08Z"
}
}
advisories/unreviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json → advisories/github-reviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-8hp3-rmr7-xh88",
"modified": "2024-02-17T06:30:35Z",
"modified": "2024-02-20T23:47:36Z",
"published": "2024-02-17T06:30:35Z",
"aliases": [
"CVE-2024-21497"
],
"summary": "Open Redirect in github.com/greenpau/caddy-security",
"details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/greenpau/caddy-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.23"
}
]
}
]
}
],
"references": [
{
@@ -32,6 +51,10 @@
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249861"
},
{
"type": "PACKAGE",
"url": "github.com/greenpau/caddy-security"
}
],
"database_specific": {
@@ -39,8 +62,8 @@
"CWE-601"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-20T23:47:36Z",
"nvd_published_at": "2024-02-17T05:15:09Z"
}
}
advisories/unreviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json → advisories/github-reviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-c7vf-m394-m4x4",
"modified": "2024-02-17T06:30:34Z",
"modified": "2024-02-20T23:45:44Z",
"published": "2024-02-17T06:30:34Z",
"aliases": [
"CVE-2024-21495"
],
"summary": "Use of Insufficiently Random Values in github.com/greenpau/caddy-security",
"details": "Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/greenpau/caddy-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.0.42"
}
]
}
]
}
],
"references": [
{
@@ -36,6 +55,10 @@
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275"
},
{
"type": "PACKAGE",
"url": "github.com/greenpau/caddy-security"
}
],
"database_specific": {
@@ -43,8 +66,8 @@
"CWE-330"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-20T23:45:44Z",
"nvd_published_at": "2024-02-17T05:15:09Z"
}
}
advisories/unreviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json → advisories/github-reviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-ff72-ff42-c3gw",
"modified": "2024-02-17T06:30:34Z",
"modified": "2024-02-20T23:46:51Z",
"published": "2024-02-17T06:30:34Z",
"aliases": [
"CVE-2024-21496"
],
"summary": "Cross-site Scripting in github.com/greenpau/caddy-security",
"details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], [\"], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/greenpau/caddy-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.23"
}
]
}
]
}
],
"references": [
{
@@ -32,6 +51,10 @@
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860"
},
{
"type": "PACKAGE",
"url": "github.com/greenpau/caddy-security"
}
],
"database_specific": {
@@ -39,8 +62,8 @@
"CWE-79"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-20T23:46:51Z",
"nvd_published_at": "2024-02-17T05:15:09Z"
}
}
advisories/unreviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json → advisories/github-reviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json
+27 -4
View File
@@ -1,11 +1,12 @@
{
"schema_version": "1.4.0",
"id": "GHSA-vj36-3ccr-6563",
"modified": "2024-02-17T06:30:34Z",
"modified": "2024-02-20T23:46:27Z",
"published": "2024-02-17T06:30:34Z",
"aliases": [
"CVE-2024-21494"
],
"summary": "Authentication Bypass by Spoofing in github.com/greenpau/caddy-security",
"details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user identity module (/whoami API endpoint). This could lead to unauthorized access if the system trusts this spoofed IP address.",
"severity": [
{
@@ -14,7 +15,25 @@
}
],
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/greenpau/caddy-security"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"last_affected": "1.1.23"
}
]
}
]
}
],
"references": [
{
@@ -32,6 +51,10 @@
{
"type": "WEB",
"url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249859"
},
{
"type": "PACKAGE",
"url": "github.com/greenpau/caddy-security"
}
],
"database_specific": {
@@ -39,8 +62,8 @@
"CWE-290"
],
"severity": "MODERATE",
"github_reviewed": false,
"github_reviewed_at": null,
"github_reviewed": true,
"github_reviewed_at": "2024-02-20T23:46:27Z",
"nvd_published_at": "2024-02-17T05:15:09Z"
}
}