From 048d083331399043a75864d73405cd9332f432e5 Mon Sep 17 00:00:00 2001 From: "advisory-database[bot]" <45398580+advisory-database[bot]@users.noreply.github.com> Date: Mon, 28 Oct 2024 19:45:12 +0000 Subject: [PATCH] Publish Advisories GHSA-ghjw-32xw-ffwr GHSA-j945-c44v-97g6 GHSA-v9xq-2mvm-x8xc --- .../GHSA-ghjw-32xw-ffwr.json | 8 ++- .../GHSA-j945-c44v-97g6.json | 8 ++- .../GHSA-v9xq-2mvm-x8xc.json | 65 +++++++++++++++++++ 3 files changed, 77 insertions(+), 4 deletions(-) create mode 100644 advisories/github-reviewed/2024/10/GHSA-v9xq-2mvm-x8xc/GHSA-v9xq-2mvm-x8xc.json diff --git a/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json b/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json index db6e944c598..a0700a17173 100644 --- a/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json +++ b/advisories/github-reviewed/2024/10/GHSA-ghjw-32xw-ffwr/GHSA-ghjw-32xw-ffwr.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-ghjw-32xw-ffwr", - "modified": "2024-10-28T18:28:03Z", + "modified": "2024-10-28T19:44:05Z", "published": "2024-10-28T18:28:03Z", "aliases": [ "CVE-2024-47827" @@ -47,6 +47,10 @@ "type": "WEB", "url": "https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47827" + }, { "type": "WEB", "url": "https://github.com/argoproj/argo-workflows/pull/13641" @@ -72,6 +76,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-10-28T18:28:03Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-28T16:15:03Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json b/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json index d567728495f..1ad63de42d5 100644 --- a/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json +++ b/advisories/github-reviewed/2024/10/GHSA-j945-c44v-97g6/GHSA-j945-c44v-97g6.json @@ -1,7 +1,7 @@ { "schema_version": "1.4.0", "id": "GHSA-j945-c44v-97g6", - "modified": "2024-10-28T18:30:32Z", + "modified": "2024-10-28T19:44:10Z", "published": "2024-10-28T18:30:32Z", "aliases": [ "CVE-2024-49771" @@ -158,6 +158,10 @@ "type": "WEB", "url": "https://github.com/joniles/mpxj/security/advisories/GHSA-j945-c44v-97g6" }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49771" + }, { "type": "WEB", "url": "https://github.com/joniles/mpxj/commit/8002802890dfdc8bc74259f37e053e15b827eea0" @@ -174,6 +178,6 @@ "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2024-10-28T18:30:32Z", - "nvd_published_at": null + "nvd_published_at": "2024-10-28T17:15:04Z" } } \ No newline at end of file diff --git a/advisories/github-reviewed/2024/10/GHSA-v9xq-2mvm-x8xc/GHSA-v9xq-2mvm-x8xc.json b/advisories/github-reviewed/2024/10/GHSA-v9xq-2mvm-x8xc/GHSA-v9xq-2mvm-x8xc.json new file mode 100644 index 00000000000..16414ea56e1 --- /dev/null +++ b/advisories/github-reviewed/2024/10/GHSA-v9xq-2mvm-x8xc/GHSA-v9xq-2mvm-x8xc.json @@ -0,0 +1,65 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-v9xq-2mvm-x8xc", + "modified": "2024-10-28T19:44:10Z", + "published": "2024-10-28T19:44:10Z", + "aliases": [ + "CVE-2024-49755" + ], + "summary": "Duende IdentityServer has insufficient validation of DPoP cnf claim in Local APIs ", + "details": "### Impact\nIdentityServer's local API authentication handler performs insufficient validation of the `cnf` claim in DPoP access tokens. This allows an attacker to use leaked DPoP access tokens at local api endpoints even without possessing the private key for signing proof tokens.\n\nNote that this only impacts custom endpoints within an IdentityServer implementation that have explicitly used the `LocalApiAuthenticationHandler` for authentication. It does not impact:\n- OAuth or OIDC protocol endpoints defined by IdentityServer, such as the authorize and token endpoints.\n- Typical UI pages within an IdentityServer implementation, which are not normally authorized with the local API authentication handler.\n- The use of DPoP to create sender-constrained tokens in IdentityServer that are consumed by external API resources.\n- The use of DPoP to sender-constrain refresh tokens issued to public clients.\n\n## Are you affected?\n\nThis vulnerability only affects IdentityServer implementations that are using the local APIs feature of IdentityServer and have explicitly enabled DPoP for local APIs. The local api authentication handler is configured with a call to either `AddLocalApi` or `AddLocalApiAuthentication`, and the opt-in to DPoP for local APIs is enabled via the `TokenMode` option. \n\nVulnerable implementations of IdentityServer would have configuration code similar to the following:\n\n```cs\nservices.AddAuthentication()\n .AddLocalApi(\"local\", options => \n {\n options.TokenMode = LocalApiTokenMode.DPoPAndBearer; // or LocalApiTokenMode.DPoPOnly\n });\n```\n\n### Patches\nThis vulnerability is patched in IdentityServer 7.0.8. Version 6.3 and below are unaffected, as they do not support DPoP in Local APIs.\n", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N" + }, + { + "type": "CVSS_V4", + "score": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "NuGet", + "name": "Duende.IdentityServer" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "7.0.0" + }, + { + "fixed": "7.0.8" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/DuendeSoftware/IdentityServer/security/advisories/GHSA-v9xq-2mvm-x8xc" + }, + { + "type": "WEB", + "url": "https://github.com/DuendeSoftware/IdentityServer/commit/f28cac921c1f545afe65af71a9327224755b6dac" + }, + { + "type": "PACKAGE", + "url": "https://github.com/DuendeSoftware/IdentityServer" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-287" + ], + "severity": "LOW", + "github_reviewed": true, + "github_reviewed_at": "2024-10-28T19:44:10Z", + "nvd_published_at": null + } +} \ No newline at end of file