Publish Advisories

GHSA-7wqh-767x-r66v
GHSA-x7hr-w5r2-h6wg

advisories/github-reviewed/2025/03/GHSA-7wqh-767x-r66v/GHSA-7wqh-767x-r66v.json

@@ -0,0 +1,99 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-7wqh-767x-r66v",
+  "modified": "2025-03-10T22:19:30Z",
+  "published": "2025-03-10T22:19:30Z",
+  "aliases": [
+    "CVE-2025-27610"
+  ],
+  "summary": "Local File Inclusion in Rack::Static",
+  "details": "## Summary\n\n`Rack::Static` can serve files under the specified `root:` even if `urls:` are provided, which may expose other files under the specified `root:` unexpectedly.\n\n## Details\n\nThe vulnerability occurs because `Rack::Static` does not properly sanitize user-supplied paths before serving files. Specifically, encoded path traversal sequences are not correctly validated, allowing attackers to access files outside the designated static file directory.\n\n## Impact\n\nBy exploiting this vulnerability, an attacker can gain access to all files under the specified `root:` directory, provided they are able to determine then path of the file.\n\n## Mitigation\n\n- Update to the latest version of Rack, or\n- Remove usage of `Rack::Static`, or\n- Ensure that `root:` points at a directory path which only contains files which should be accessed publicly.\n\nIt is likely that a CDN or similar static file server would also mitigate the issue.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "rack"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.2.13"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "rack"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.0"
+            },
+            {
+              "fixed": "3.0.14"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "RubyGems",
+        "name": "rack"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "3.1"
+            },
+            {
+              "fixed": "3.1.12"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "WEB",
+      "url": "https://github.com/rack/rack/security/advisories/GHSA-7wqh-767x-r66v"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/rack/rack/commit/50caab74fa01ee8f5dbdee7bb2782126d20c6583"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/rack/rack"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-23"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-03-10T22:19:30Z",
+    "nvd_published_at": null
+  }
+}

advisories/github-reviewed/2025/03/GHSA-x7hr-w5r2-h6wg/GHSA-x7hr-w5r2-h6wg.json

@@ -1,7 +1,7 @@
 {
   "schema_version": "1.4.0",
   "id": "GHSA-x7hr-w5r2-h6wg",
-  "modified": "2025-03-03T20:16:32Z",
+  "modified": "2025-03-10T22:19:21Z",
   "published": "2025-03-03T09:30:34Z",
   "aliases": [
     "CVE-2024-53382"
@@ -28,7 +28,7 @@
               "introduced": "0"
             },
             {
-              "last_affected": "1.29.0"
+              "fixed": "1.30.0"
             }
           ]
         }
@@ -40,6 +40,14 @@
       "type": "ADVISORY",
       "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-53382"
     },
+    {
+      "type": "WEB",
+      "url": "https://github.com/PrismJS/prism/pull/3863"
+    },
+    {
+      "type": "WEB",
+      "url": "https://github.com/PrismJS/prism/commit/8e8b9352dac64457194dd9e51096b4772532e53d"
+    },
     {
       "type": "WEB",
       "url": "https://gist.github.com/jackfromeast/aeb128e44f05f95828a1a824708df660"