From 01aaf1b6fe7724b2f978d52d2b7c7bbf880810d3 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Tue, 20 Feb 2024 23:47:57 +0000 Subject: [PATCH] Publish Advisories GHSA-8h95-jcp5-pjpr GHSA-8hp3-rmr7-xh88 GHSA-c7vf-m394-m4x4 GHSA-ff72-ff42-c3gw GHSA-vj36-3ccr-6563 --- .../GHSA-8h95-jcp5-pjpr.json | 31 ++++++++++++++++--- .../GHSA-8hp3-rmr7-xh88.json | 31 ++++++++++++++++--- .../GHSA-c7vf-m394-m4x4.json | 31 ++++++++++++++++--- .../GHSA-ff72-ff42-c3gw.json | 31 ++++++++++++++++--- .../GHSA-vj36-3ccr-6563.json | 31 ++++++++++++++++--- 5 files changed, 135 insertions(+), 20 deletions(-) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json (68%) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json (68%) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json (70%) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json (70%) rename advisories/{unreviewed => github-reviewed}/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json (66%) diff --git a/advisories/unreviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json b/advisories/github-reviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json similarity index 68% rename from advisories/unreviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json rename to advisories/github-reviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json index 8b6fb5cccf8..21ec40a53b1 100644 --- a/advisories/unreviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json +++ b/advisories/github-reviewed/2024/02/GHSA-8h95-jcp5-pjpr/GHSA-8h95-jcp5-pjpr.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8h95-jcp5-pjpr", - "modified": "2024-02-17T06:30:35Z", + "modified": "2024-02-20T23:47:20Z", "published": "2024-02-17T06:30:34Z", "aliases": [ "CVE-2024-21493" ], + "summary": "Improper Validation of Array Index in github.com/greenpau/caddy-security", "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile. Multiple parsing functions in the affected library do not validate whether their input values are nil before attempting to access elements, which can lead to a panic (index out of range). Panics during the parsing of a configuration file may introduce ambiguity and vulnerabilities, hindering the correct interpretation and configuration of the web server.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/greenpau/caddy-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.23" + } + ] + } + ] + } ], "references": [ { @@ -32,6 +51,10 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-5961078" + }, + { + "type": "PACKAGE", + "url": "github.com/greenpau/caddy-security" } ], "database_specific": { @@ -39,8 +62,8 @@ "CWE-129" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-20T23:47:20Z", "nvd_published_at": "2024-02-17T05:15:08Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json b/advisories/github-reviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json similarity index 68% rename from advisories/unreviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json rename to advisories/github-reviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json index 585c8eefc3e..cfd0c7ef16d 100644 --- a/advisories/unreviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json +++ b/advisories/github-reviewed/2024/02/GHSA-8hp3-rmr7-xh88/GHSA-8hp3-rmr7-xh88.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-8hp3-rmr7-xh88", - "modified": "2024-02-17T06:30:35Z", + "modified": "2024-02-20T23:47:36Z", "published": "2024-02-17T06:30:35Z", "aliases": [ "CVE-2024-21497" ], + "summary": "Open Redirect in github.com/greenpau/caddy-security", "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter. An attacker could perform a phishing attack and trick users into visiting a malicious website by crafting a convincing URL with this parameter. To exploit this vulnerability, the user must take an action, such as clicking on a portal button or using the browser’s back button, to trigger the redirection.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/greenpau/caddy-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.23" + } + ] + } + ] + } ], "references": [ { @@ -32,6 +51,10 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249861" + }, + { + "type": "PACKAGE", + "url": "github.com/greenpau/caddy-security" } ], "database_specific": { @@ -39,8 +62,8 @@ "CWE-601" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-20T23:47:36Z", "nvd_published_at": "2024-02-17T05:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json b/advisories/github-reviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json similarity index 70% rename from advisories/unreviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json rename to advisories/github-reviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json index 0d9e63389a4..032d41dea48 100644 --- a/advisories/unreviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json +++ b/advisories/github-reviewed/2024/02/GHSA-c7vf-m394-m4x4/GHSA-c7vf-m394-m4x4.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-c7vf-m394-m4x4", - "modified": "2024-02-17T06:30:34Z", + "modified": "2024-02-20T23:45:44Z", "published": "2024-02-17T06:30:34Z", "aliases": [ "CVE-2024-21495" ], + "summary": "Use of Insufficiently Random Values in github.com/greenpau/caddy-security", "details": "Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/greenpau/caddy-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.0.42" + } + ] + } + ] + } ], "references": [ { @@ -36,6 +55,10 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6248275" + }, + { + "type": "PACKAGE", + "url": "github.com/greenpau/caddy-security" } ], "database_specific": { @@ -43,8 +66,8 @@ "CWE-330" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-20T23:45:44Z", "nvd_published_at": "2024-02-17T05:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json b/advisories/github-reviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json similarity index 70% rename from advisories/unreviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json rename to advisories/github-reviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json index f6fe0965005..42566e72710 100644 --- a/advisories/unreviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json +++ b/advisories/github-reviewed/2024/02/GHSA-ff72-ff42-c3gw/GHSA-ff72-ff42-c3gw.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-ff72-ff42-c3gw", - "modified": "2024-02-17T06:30:34Z", + "modified": "2024-02-20T23:46:51Z", "published": "2024-02-17T06:30:34Z", "aliases": [ "CVE-2024-21496" ], + "summary": "Cross-site Scripting in github.com/greenpau/caddy-security", "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that can allow XSS (e.g., [&], [<], [>], [\"], [']), it does not account for the attack based on the JavaScript URL scheme (e.g., javascript:alert(document.domain)// payload). Exploiting this vulnerability may not be trivial, but it could lead to the execution of malicious scripts in the context of the target user’s browser, compromising user sessions.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/greenpau/caddy-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.23" + } + ] + } + ] + } ], "references": [ { @@ -32,6 +51,10 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249860" + }, + { + "type": "PACKAGE", + "url": "github.com/greenpau/caddy-security" } ], "database_specific": { @@ -39,8 +62,8 @@ "CWE-79" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-20T23:46:51Z", "nvd_published_at": "2024-02-17T05:15:09Z" } } \ No newline at end of file diff --git a/advisories/unreviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json b/advisories/github-reviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json similarity index 66% rename from advisories/unreviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json rename to advisories/github-reviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json index cbc0bdf6e36..ffbc208fe1d 100644 --- a/advisories/unreviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json +++ b/advisories/github-reviewed/2024/02/GHSA-vj36-3ccr-6563/GHSA-vj36-3ccr-6563.json @@ -1,11 +1,12 @@ { "schema_version": "1.4.0", "id": "GHSA-vj36-3ccr-6563", - "modified": "2024-02-17T06:30:34Z", + "modified": "2024-02-20T23:46:27Z", "published": "2024-02-17T06:30:34Z", "aliases": [ "CVE-2024-21494" ], + "summary": "Authentication Bypass by Spoofing in github.com/greenpau/caddy-security", "details": "All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For header due to improper input sanitization. An attacker can spoof an IP address used in the user identity module (/whoami API endpoint). This could lead to unauthorized access if the system trusts this spoofed IP address.", "severity": [ { @@ -14,7 +15,25 @@ } ], "affected": [ - + { + "package": { + "ecosystem": "Go", + "name": "github.com/greenpau/caddy-security" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "last_affected": "1.1.23" + } + ] + } + ] + } ], "references": [ { @@ -32,6 +51,10 @@ { "type": "WEB", "url": "https://security.snyk.io/vuln/SNYK-GOLANG-GITHUBCOMGREENPAUCADDYSECURITY-6249859" + }, + { + "type": "PACKAGE", + "url": "github.com/greenpau/caddy-security" } ], "database_specific": { @@ -39,8 +62,8 @@ "CWE-290" ], "severity": "MODERATE", - "github_reviewed": false, - "github_reviewed_at": null, + "github_reviewed": true, + "github_reviewed_at": "2024-02-20T23:46:27Z", "nvd_published_at": "2024-02-17T05:15:09Z" } } \ No newline at end of file